Skip to main content

Why can't I make direct front-end API requests to the platform?

Updated

Symptoms

You see a CORS error in your browser when your website makes a direct request to an API endpoint. For example:

Access to fetch at '<Bloomreach API URL>' from origin '<your website>' has been blocked by CORS policy

The same request might work in Postman, cURL, or another server-side tool.

Explanation

Our API endpoints are not designed to accept direct requests from browser-based front-end code. When a webpage sends a request to a different domain, the browser checks the Cross-Origin Resource Sharing (CORS) policy. Bloomreach rejects direct front-end requests when the webpage origin differs from the API domain.

This behavior is intentional. API requests can contain sensitive authentication data, including API keys or secrets. Allowing arbitrary webpages to call these endpoints could expose your credentials and allow unauthorized access to your project.

A successful request from Postman or cURL does not mean that the endpoint supports browser requests. These tools send the request outside the webpage’s browser origin, so the browser’s CORS restriction does not apply in the same way.

Supported ways to interact with Bloomreach from a website

Use the JavaScript SDK

Use the JavaScript SDK for browser-based functionality such as customer identification, customer updates, event tracking, and web personalization.

The SDK provides the supported front-end integration and handles communication with the platform according to the SDK flow. Do not replace SDK methods with direct fetch, Axios, or XMLHttpRequest calls to API endpoints.

See JS SDK Integration and Tracking for setup and supported methods.

Use your own backend

For API functionality that the JavaScript SDK does not provide, send the request through your own server-side application:

  1. Send a request from the browser to your own backend endpoint.

  2. Let your backend authenticate with Bloomreach and call the required API endpoint.

  3. Process the response on your backend.

  4. Return only the data your webpage needs.

Keep your Bloomreach API key and secret on the server. Never include them in front-end JavaScript, page source, or browser-visible configuration.

What you cannot fix in the front end

  • Adding an Access-Control-Allow-Origin header to your request does not enable the endpoint to accept the request. The server response provides CORS permission.

  • Disabling browser security is not a supported solution.

  • A request working in Postman does not prove that the same request is supported from a webpage.

Summary

You cannot call API endpoints directly from browser-based front-end code. Use the JavaScript SDK for supported website functionality, or send API requests from your own backend and return the required result to the webpage.