Frequently asked questions

Quick answers to the questions that show up in our inbox.

Do you log my requests?

Yes. Each proxy request is logged to our database (Cloudflare D1) with: timestamp, user and key IDs, method, path, target URL, client IP, user agent, status, response time, request and response size, error code, country, Cloudflare data centre, referer, Cloudflare ray ID and bot score. Request and response bodies are not stored. Logs are kept for 30 days and then deleted by a daily cleanup job. The data is visible to the account that made the request, and to the operations team for incident response.

Can I proxy authenticated endpoints?

Yes. The proxy strips the browser's own Authorization and Cookie headers, so they never reach the upstream by accident. To authenticate to the upstream, store the secret as a managed upstream header on your API key: it lives server-side, is injected by the proxy for the target host you choose, and never appears in your frontend code. For one-off cases you can also set an upstream header per request with the reqHeaders parameter, including Authorization. Avoid putting tokens in the URL, where they end up in logs and browser history.

Can I self-host instead?

You can self-host a simpler, separate open-source CORS relay: github.com/melihbirim/corsproxy, a single Go program under the MIT licence with no external dependencies. It is not the code that runs corsproxy.dev. It has no accounts, API keys, daily quotas, managed upstream headers or caching, and it forwards request headers (including Cookie and Authorization) as they arrive. The hosted service is a separate program with those features.

What's your uptime SLA?

There is no SLA on the Free or Pro plans; both run best-effort on Cloudflare Workers. Enterprise plans include an SLA, so contact us if you need one. Current status is published on the status page.

Are you GDPR-compliant?

We aim to keep personal data to a minimum. Sign-in is passwordless (an email link), so no passwords are stored: we keep your email address plus account metadata such as API keys and usage. Request logs are retained for 30 days, and the dashboard offers data export and full account deletion. The data lives on Cloudflare's network; see the Privacy Policy for the data-transfer details.

What happens when I hit my daily limit?

Further requests return HTTP 429 with the code RATE_LIMIT_EXCEEDED. Successful proxied responses carry X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used and X-RateLimit-Reset (Unix seconds), so you can slow down before you hit the limit. The 429 itself carries no rate-limit headers; its error message gives the reset time (the next 00:00 UTC). There is no Retry-After header. We also email the account owner when the limit is reached. Upgrades are handled from the Upgrade page.

Do you cache responses?

Not by default: without a ttl parameter, every request is a fresh upstream fetch. On the Pro plan you can opt in per request with ttl (1 to 86400 seconds), which caches 200 responses to GET requests at Cloudflare's edge for that long.

Can I use this in production?

It depends on your security posture and uptime needs. Free and Pro have no SLA; Enterprise does. If your data is sensitive, the long-term answer is usually to add CORS headers on the upstream itself, or to run your own relay (for example the open-source one) inside your own perimeter. The managed API suits cases where a public proxy is acceptable, which covers many public-data API integrations.

Why not just configure CORS server-side?

You should, when you control the upstream. The proxy exists for the cases where you don't: third-party APIs, partner systems, legacy services. See our guide on CORS errors.