# CORS "Unauthorized origin" errors after deploying to our staging subdomain

Asked by Owen Prescott on 2024-05-06. Tags: errors, cors, setup.

Deployed our site to staging.brand.com and every single Croct request now fails.
Production on brand.com works fine, same code, same app ID.

Console shows:

```
Access to fetch at 'https://api.croct.io/client/web/evaluate' from origin
'https://staging.brand.com' has been blocked by CORS policy
```

and the SDK surfaces it as an "Unauthorized origin" error. Nothing changed in the
code between environments so what changed on the Croct side?

## 1 answer

### Accepted answer from ruben_s (2024-05-06)

Nothing changed on the Croct side, the staging domain was just never
registered. "Unauthorized origin" means the requesting domain is not in your
application's trusted origins list. Production works because brand.com is in
the list; staging.brand.com is a different origin and needs its own entry.

Go to the application settings in the dashboard and add the staging domain to
trusted origins. Requests start passing as soon as it is saved, no redeploy
needed.

Worth doing for every environment you spin up, by the way. Trusted origins
also gate preview links, so an untrusted domain silently breaks the preview
flow too, and that one is much more confusing to debug than a CORS error in
the console.

#### Reply from Owen Prescott (2024-05-06)

Added staging.brand.com to trusted origins and everything works. Good tip
on preview links, would definitely have hit that next.