---
schema_version: "1"
id: 10e7be2ace172b53205f6f139dbea81cc6d0320daac368e57049eb93a0b165c8
title: Enable CORS for OAuth Endpoints
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_endpoints_cors.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_endpoints_cors.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8360ff4ee197f466e52f221c55c864530561c5b8805a7db6ccad98585541d410
description: Web applications use Cross-Origin Resource Sharing (CORS) to request resources from origins other than their own. For example, a web page can use CORS to request information about a user from your My Domain login URL or Experience Cloud site URL. In addition to public and allowlisted web pages, Salesforce supports CORS for certain OAuth endpoints when requested from a My Domain login URL or Experience Cloud site URL.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Enable CORS for OAuth Endpoints

Web applications use Cross-Origin Resource Sharing (CORS) to request resources from origins other than their own. For example, a web page can use CORS to request information about a user from your My Domain login URL or Experience Cloud site URL. In addition to public and allowlisted web pages, Salesforce supports CORS for certain OAuth endpoints when requested from a My Domain login URL or Experience Cloud site URL.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d11828e40">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d11828e40 ">To create, read, update, and delete:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d11828e40 ">Modify All Data AND Customize Application</td>
          </tr>
        </tbody>
      </table>

CORS is automatically enabled for these endpoints.

- `/.well-known/openid-configuration`
- `/.well-known/auth-configuration`
- `/services/oauth2/id/keys`

In addition, you can enable CORS for the `/services/oauth2/userinfo` endpoint by adding the origin URL of the web application serving the code to the CORS allowlist.

You can also enable CORS for these endpoints by selecting the Enable CORS for OAuth endpoints checkbox. Salesforce supports CORS for these endpoints only for certain host domains.

 
| Endpoint | Supported Host Domains for CORS |
| --- | --- |
| `/services/oauth2/token` | My Domain or Experience Cloud site URLs |
| `/services/oauth2/revoke` | My Domain or Experience Cloud site URLs |
| `/services/oauth2/introspect` | My Domain or Experience Cloud site URLs |
| `services/oauth2/authorize` | My Domain or Experience Cloud site URLs |
| `services/oauth2/pkce/generator` | My Domain or Experience Cloud site URLs |
| `services/auth/headless/init/registration` | Experience Cloud site URLs only |
| `services/auth/headless/init/passwordless/login` | Experience Cloud site URLs only |
| `services/auth/headless/forgot_password` | Experience Cloud site URLs only |

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_warning.png)

Warning Some OAuth authorization flows contain a consumer secret. We strongly recommend that you protect the consumer secret from being exposed to end users.

To enable CORS for the endpoints listed in the table, take these steps.

1. From Setup, in the Quick Find box, enter CORS, and then select **CORS**.
2. Add the origin URL of the web application serving the code to a CORS allowlist.
3. In the Cross-Origin Resource Sharing (CORS) Policy Settings section, click **Edit**.
4. Select **Enable CORS for OAuth endpoints**.
5. Save your work.