---
schema_version: "1"
id: 8074c05baaa7b9cdbab45286e40b9acb81f21272b76985accedee2a739a489b0
title: Set Up Cross-Origin Resource Sharing (CORS)
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/security/headless-identity-impl-guide/guides/headless-identity/headless-identity-cors.md
canonical_url: https://developer.salesforce.com/docs/platform/headless-identity-impl-guide/guide/headless-identity-cors.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 4336a6cafc1583b869d29c91d64ef7217f2db9f9cebe062c2c5eb61c57e27c83
products:
  - Headless Identity Implementation Guide
  - Security
---

# Set Up Cross-Origin Resource Sharing (CORS)

In production, to use Headless Identity features in a web app, you must enable Cross-Origin Resource Sharing (CORS) so that your app can communicate with Salesforce. This step isn’t necessary for the example implementation in this guide, so you can skip it for now. But if you want to learn how to set up CORS, here’s how it’s done.

|Required Editions|
|-----------------|
|Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience|
|Available in: **Enterprise**, **Unlimited**, and **Developer** Editions|

|User Permissions Needed| |
|-----------------------|--|
|To create, read, update, and delete:|Modify All Data|

In production, you set up CORS using the domain of your off-platform app. For this example implementation, if you don’t have a test app in mind, you can create one using[ Heroku](https://www.salesforce.com/editions-pricing/heroku/)—you can try a basic account for free. Later in this guide, you can use the same app when you implement reCAPTCHA.

1.  From Setup, in the Quick Find box, enter `CORS`, and then select **CORS**.

2.  For Allowed Origins List, click **New**.

3.  Enter a URL pattern that can identify your web app. For example, if your app is hosted on myapp.com, you enter `https://www.myapp.com`.

4.  Save your changes.

    Your web app can now request resources from Salesforce.