> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailofly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CORS Issues

> Why browser fetch requests to the Mailofly API trigger CORS errors and how to send emails securely.

# CORS Issues

If you attempt to call `https://api.mailofly.com/api/v1/emails` directly from client-side browser JavaScript (e.g. React, Vue, Svelte, or vanilla `fetch`), you will encounter a **Cross-Origin Resource Sharing (CORS)** error.

***

## Why Client-Side Sending is Blocked

The Mailofly API requires a secret API key (`mf_live_...`) in the `Authorization` header.

<Warning>
  **Never expose secret API keys in client-side code!**
  If you call Mailofly directly from a browser, your API key will be visible in web inspector network tabs and client bundles, allowing malicious actors to steal your key, hijack your quota, and send unauthorized spam from your domain.
</Warning>

To protect your credentials and domain reputation, Mailofly does not include permissive `Access-Control-Allow-Origin: *` headers on sending endpoints.

***

## How to Solve CORS

Send emails via a secure backend server, API route, or serverless function:

### Next.js (App Router Server Action)

```typescript app/actions/send-email.ts theme={null}
"use server";

import { Mailofly } from "mailofly";

const mailofly = new Mailofly(process.env.MAILOFLY_API_KEY!);

export async function submitContactForm(formData: FormData) {
  const email = formData.get("email") as string;
  const message = formData.get("message") as string;

  return await mailofly.emails.send({
    from: "Acme Support <support@acme.com>",
    to: ["team@acme.com"],
    subject: "New Contact Form Submission",
    text: `From: ${email}\n\n${message}`,
  });
}
```

### Express / Node.js Backend

```javascript server.js theme={null}
app.post("/api/contact", async (req, res) => {
  const { email, message } = req.body;

  try {
    await mailofly.emails.send({
      from: "Acme Support <support@acme.com>",
      to: ["team@acme.com"],
      subject: "Contact Form",
      text: message,
    });
    res.json({ success: true });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});
```


## Related topics

- [Introduction](/audience/introduction.md)
- [Performance Tracking](/broadcasts/performance-tracking.md)
- [Delivered Email Not Arriving](/guides/deliverability/delivered-email-not-arriving.md)
- [Domain Not Verifying](/guides/domains/domain-not-verifying.md)
- [Error 1010](/guides/domains/error-1010.md)