CORS settings
Cross-origin access
By default, every image we serve allows use from any website — canvases, WebGL textures, and scripts that read pixel data all work without configuration. Projects on Business and above can narrow that to an explicit allowlist of origins; every plan can see the active configuration in the dashboard.
The default: any origin
Responses carry Access-Control-Allow-Origin: *, and preflight OPTIONS requests are answered directly at the edge (a 204 allowing GET, HEAD, OPTIONS, cached by the browser for 24 hours). Image delivery here is public and credential-less, so the wildcard is safe — there is no cookie or session a cross-origin reader could exfiltrate.
Restricting to an allowlist
On Business and above, open your project’s CORS panel in the dashboard and list the origins that may read your images. While a list is active:
- A request whose
Originmatches an entry gets that origin echoed back inAccess-Control-Allow-Origin, plusVary: Originso shared caches keep the responses separate. - A request from any other origin gets no allow-origin header, so the browser blocks cross-origin reads. The image itself still serves — plain
<img>tags everywhere keep working; only cross-origin reading (canvas, fetch) is restricted. - Preflights give the same per-origin answer.
- Error responses (4xx/5xx) always allow any origin — they carry no image data, and this keeps failures readable by your monitoring from anywhere.
Allowlist rules
| Rule | Value |
|---|---|
| Entries per project | up to 6 |
| Format | https://host or http://host, optionally with a port — exactly what the browser sends in Origin. No path, no trailing slash. |
| Length | up to 100 characters per entry |
| Methods | fixed at GET, HEAD, OPTIONS — delivery is read-only, and there is no credentials mode |
Six entries cover the usual shapes — apex + www, a staging host, an app domain or two. Origins compare by exact bytes, so https://example.com/ (with a slash) would never match; the dashboard rejects near-miss formats at save time instead of letting them silently fail.
Plan changes
The panel is visible on every plan. If your plan moves below Business, your saved list is kept but becomes inactive — delivery reverts to any-origin (*) until the plan is upgraded again, at which point the saved list re-applies.
Good to know
- Changes publish to the edge and take effect within a few minutes.
- Fonts, stylesheets, and plain image tags never send a preflight — if you are debugging a cross-origin failure on those, see Troubleshooting first.
- Cached responses respect the setting too: the header is applied per request, after the cache, so a cache hit and a miss answer identically.