Debugging / CORS & keys
Calling From a Browser
Browser calls fail for two different reasons: the origin is not allowed, and API keys must never be in client code. Both are fixed the same way.
Two problems
Why the request fails
- The origin is not allowed
- Cross-origin browser requests only succeed from origins the API is configured to allow. A blocked request shows up as a CORS error in the browser console, even though the API itself never rejected your credentials.
- The key cannot be there
- Anything in client-side JavaScript is readable by your users. An API key in a browser bundle is a leaked key, so this is a design problem rather than a configuration one.
Both problems disappear with the same change: call MemorySync from your own server and let the browser talk to your endpoint.
Pattern
The pattern that works
Avoid
// browser — do not do this
await fetch("https://api.memorysync.io/memory/query", {
method: "POST",
headers: { "X-API-Key": "ms_live_…" }, // visible to every user
body: JSON.stringify({ query }),
});Even if the origin were allowed, the key is now public. Treat any key that has shipped to a browser as compromised and rotate it.