# Getting CORS ERROR while calling GraphQL API

**URL:** <https://community.shopify.com/t/getting-cors-error-while-calling-graphql-api/614945>\
**Category:** Technical Q&A\
**Tags:** troubleshooting\
**Created:** [April 27, 2026, 3:45pm UTC](https://community.shopify.com/t/getting-cors-error-while-calling-graphql-api/614945 "2026-04-27T15:45:10Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![software-clever](https://yyz1.discourse-cdn.com/shopifyforum/user_avatar/community.shopify.com/software-clever/32/401248_2.png) [@software-clever](https://community.shopify.com/u/software-clever)\
**Post date:** [April 27, 2026, 4:20pm UTC](https://community.shopify.com/t/getting-cors-error-while-calling-graphql-api/614945/3 "2026-04-27T16:20:45Z")

</div>

The Admin API is blocked from browser calls on purpose. Shopify deliberately  
doesn’t set CORS headers on `/admin/api/...` endpoints — it’s not a bug to  
work around, it’s how the platform protects your Admin access token. Even if  
you found a header trick, your token would be visible to anyone viewing the  
page source.

What to use depends on what you’re trying to do:

1. **Product/price data on a customer-facing page** → use the Storefront API:  
`https://<shop>.myshopify.com/api/2025-07/graphql.json` with a public  
storefront access token in `X-Shopify-Storefront-Access-Token`. It’s  
designed for browser calls, has CORS support, and the storefront token is  
intentionally low-trust and safe to ship in client code. Note: product  
metafields are only visible via the Storefront API if you’ve explicitly  
exposed them — Admin → Settings → Custom data → Storefronts.

2. **Admin data (orders, customers, internal metafields, etc.)** → call from  
your own backend. A small Node or serverless endpoint makes the Admin call  
with the Admin token, and your page fetches just the result. The Admin  
token never touches the browser.

3. **Embedded Shopify app** → use App Bridge to get a session token, send it  
to your app’s backend, and have the backend call Admin GraphQL on the  
merchant’s behalf. The Shopify CLI app templates (Remix, Node) wire this  
up out of the box.

---

_[View the full topic](https://community.shopify.com/t/getting-cors-error-while-calling-graphql-api/614945)._