Skip to main content

CORS Issues

If you attempt to call https://api.mailofly.com/api/v1/emails directly from client-side browser JavaScript (e.g. React, Vue, Svelte, or vanilla fetch), you will encounter a Cross-Origin Resource Sharing (CORS) error.

Why Client-Side Sending is Blocked

The Mailofly API requires a secret API key (mf_live_...) in the Authorization header.
Never expose secret API keys in client-side code! If you call Mailofly directly from a browser, your API key will be visible in web inspector network tabs and client bundles, allowing malicious actors to steal your key, hijack your quota, and send unauthorized spam from your domain.
To protect your credentials and domain reputation, Mailofly does not include permissive Access-Control-Allow-Origin: * headers on sending endpoints.

How to Solve CORS

Send emails via a secure backend server, API route, or serverless function:

Next.js (App Router Server Action)

app/actions/send-email.ts

Express / Node.js Backend

server.js