{
  "slug": "fix-cors-error-weweb",
  "title": "Fix CORS Errors in WeWeb API Requests",
  "metaDescription": "Fix WeWeb CORS errors without exposing headers through a public proxy. RealComposer handles preflight at the edge and injects upstream auth from a vault.",
  "headline": "WeWeb REST calls that pass preflight and keep auth private",
  "category": "ecosystem",
  "categoryLabel": "Platforms & Frameworks",
  "urgency": 9,
  "clientPlatform": "WeWeb",
  "upstreamServices": [
    "REST API"
  ],
  "searchIntentQuery": "fix cors error in weweb api request",
  "directAnswerSummary": "WeWeb CORS errors happen when an API does not allow your WeWeb domain as an origin. Rather than adding auth headers to a proxied request in the app, call a RealComposer pipeline. It answers the OPTIONS preflight, returns the correct CORS headers, and attaches upstream credentials at the edge.",
  "problem": {
    "title": "Why WeWeb requests fail CORS checks",
    "explanation": "Browsers block cross-origin responses unless the API opts in. Many vendor and internal APIs do not list WeWeb editor or production domains, so collections fail with a CORS error even when the request is otherwise valid.",
    "risks": [
      "Collections failing only in the browser, not in testing tools",
      "Auth headers kept in the app while routing through a CORS proxy",
      "Different behavior between WeWeb editor and published domains"
    ]
  },
  "solutionSteps": [
    {
      "stepNumber": 1,
      "title": "Store credentials in Secret Vault",
      "description": "Save UPSTREAM_API_TOKEN in RealComposer so the value never enters the WeWeb project."
    },
    {
      "stepNumber": 2,
      "title": "Configure the edge pipeline",
      "description": "Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds."
    },
    {
      "stepNumber": 3,
      "title": "Swap the WeWeb collection URL",
      "description": "Call your workspace edge URL with a restricted rc_live_ client token.",
      "codeSnippet": "// WeWeb REST API collection\nURL:     https://realcomposer.com/v1/workspace/fix-cors-error-weweb\nHeaders: Authorization: Bearer rc_live_client_token\nProxy through WeWeb server: off"
    }
  ],
  "pipelineConfig": {
    "name": "Fix CORS Errors in WeWeb API Requests",
    "method": "GET",
    "cacheTtlSeconds": 0,
    "authMode": "client_token",
    "steps": [
      {
        "stepKey": "upstream",
        "upstreamUrlTemplate": "https://{{secrets.UPSTREAM_API_HOST}}/v1/listings",
        "httpMethod": "GET",
        "headersTemplate": {
          "Authorization": "Bearer {{secrets.UPSTREAM_API_TOKEN}}"
        },
        "timeoutMs": 5000
      }
    ],
    "outputMapping": {
      "version": 1,
      "fields": [
        {
          "targetPath": "items",
          "sourceStep": "upstream",
          "sourcePath": "results"
        }
      ]
    }
  },
  "sampleBloatedInput": {
    "results": [
      {
        "id": "lst_4",
        "title": "Loft",
        "price": 1800
      }
    ],
    "pagination": {
      "next": null
    },
    "debug": {
      "region": "us-east-1"
    }
  },
  "sampleSlimmedOutput": {
    "items": [
      {
        "id": "lst_4",
        "title": "Loft",
        "price": 1800
      }
    ]
  },
  "curlSnippet": "curl -X GET \"https://realcomposer.com/v1/workspace/fix-cors-error-weweb\" \\\n  -H \"Authorization: Bearer rc_live_client_token\"",
  "faqs": [
    {
      "question": "Should I add both WeWeb editor and production domains?",
      "answer": "Yes. Add the editor preview domain and your published domain to allowed origins so collections work while building and after launch."
    },
    {
      "question": "Do I still need the WeWeb server proxy?",
      "answer": "No. The RealComposer edge already returns valid CORS headers, so the request can go straight from the browser."
    }
  ],
  "relatedRecipeSlugs": [
    "fix-cors-error-webflow",
    "fix-cors-error-tooljet",
    "call-openai-from-weweb-securely"
  ],
  "links": {
    "page": "https://realcomposer.com/recipes/fix-cors-error-weweb",
    "markdown": "https://realcomposer.com/recipes/fix-cors-error-weweb.md",
    "json": "https://realcomposer.com/recipes/fix-cors-error-weweb.json",
    "install": "https://realcomposer.com/dashboard/pipelines/new?recipe=fix-cors-error-weweb&via=agent"
  }
}