Access Your Data (CORS)

Decide which domains can access your project data.

For security reasons, your project defaults to only respond to queries from localhost:3333 (the default local development server for Sanity Studio) and the hostname you used when deploying (if you used sanity deploy). This is primarily for reading private data and mutating data, like in Studio. Most front end apps connecting to your content won't need additional CORS configurations.

If you want to open up your project to any other origins, you need to add the host name to your allowed CORS origins (you can read more on browser security & CORS or the technicalities of CORS).

Typical reasons you'd want to add a new CORS origin include:

• You are using a non-default port when developing, so you'd open up to http://localhost:<your port>.
• You are deploying a studio outside the Sanity infrastructure (not using the sanity deploy command).
• You want to try something out on JSFiddle, you'd open to https://fiddle.jshell.net.

It's good practice to limit your origins to the smallest possible set, and never open a sensitive dataset to public playgrounds like JSFiddle. A JSFiddle example will be able to access projects you open to it with your credentials when you run it.

A CORS origin will be defined using the following format:

protocol://hostname[:port]

The protocol and host name are required while the port is optional. Wildcards (*) are allowed.

Some valid examples include:

• https://example.org
• https://*.example.org
• https://fiddle.jshell.net
• http://localhost:3000
• http://localhost:3333

When adding a CORS origin, you will also need to decide whether or not to allow credentials. If you allow credentials, the origin will be allowed to send authenticated requests using the token or session of a logged in user.

If this origin hosts a studio, you will need to allow credentials. Otherwise, you should probably select not to allow credentials.

Allowing credentials from wildcard origins is dangerous. Any domain that matches the given pattern will be able to send requests on the user's behalf if they are logged in to your studio.

You can add a CORS origin from your management console or using the command line interface (CLI).

To add a CORS origin from your management console:

• Go to https://www.sanity.io/manage.
• Pick your project from the list.
• Go to Settings, and then to API settings.
• Under CORS Origins, click the Add CORS origin button.
• Enter your Origin, select whether or not to Allow credentials, and click Save. If your origin was added successfully, it will appear at the top of your CORS origins list.

To add a CORS origin from the CLI:

• Navigate to your project's folder in your terminal.
• Run the command sanity cors add [ORIGIN], where [ORIGIN] meets the requirements listed above.
• When prompted, select whether or not to allow credentials.

You can confirm your origin was added with the statement CORS origin added successfully or by consulting the list returned by the command sanity cors list.