Has the CORS policy changed (responses API)?

API Bugs
1

My working web app just started breaking about 14 hours ago with CORS errors on the responses API. It is a local-first app served from the file:// domain but I also tested it from a real domain and it breaks there too. It is meant for individual developers who supply their own API keys, so in this situation I do not think it is a problem that a web app is making authenticated requests from the browser.

8 Likes
2

On closer inspection the OPTIONS preflight is receiving a 400 from openai.com, so no CORS headers are set and this breaks the main call.

1 Like
3

I can answer immediately about another endpoint by browser:

image

(Content policy can’t do much about the limited headers web scripting can get..)

HTTP 200  (69931 ms)
content-type: application/json
x-request-id: req_

I have no BYOK browser Responses API code with history, but could whip something up.

4

Facing the same issue. Running an app from localhost

5

Confirmed.

The same application ported over to Responses fails:

00:19:18.057 Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://api.openai.com/v1/responses. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 400.

00:19:18.060 Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://api.openai.com/v1/responses. (Reason: CORS request did not succeed). Status code: (null).

Quite simply, Chat Completions has access-control-allow-origin: null in the OPTIONS response header, Responses does not.

Repro

https://hotnova.com/playground/responses.html

(try again in a few minutes if 502)

Use your API key, stored obfuscated in browser local storage until “Clear ALL local data” button kills the domain’s store. Pick parameters compatible with AI model.

Switch URL between Chat Completions (success) and Responses (fail).

6

Facing the same issue on my BYOK app. Responses API stopped sending Access-Control-Allow-Origin header.

7

Thanks for raising this issue!
Thanks to @_j for providing the easy to repro link!

Escalated!

3 Likes
8

My team is facing the same issue using the Responses API. All OpenAI requests that were previously succeeding began failing overnight due to CORS errors.

9

Same here, Responses stopped working from browser because of CORS. @OpenAI_Support is it on purpose or it is a glitch? Is it a new policy?

10

Same issue, it was still working yesterday. Two days ago i just updated my app to support Response API instead of chat completion API! Old version with completion API is working…

1 Like
11

Oh, it is a pity when you just release an app, and it stops working….
BTW: Gemini allows calls from a browser.

12

Just adding that also /v1/images/edits is affected by this problem

1 Like
13

We have identified the issue and the fix has rolled out.

5 Likes
14

Thanks for the quick fix ! Indeed it works again.

2 Likes
15

Thanks (and "no thanks, to the one who messes with APIs)!

Reward: preset share with a Chat Completions JSON schema auto-converted to Responses text.format for transmission when picking that endpoint, with reasoning.effort, text.verbosity etc (success, first go).

1 Like
16

I almost had a stroke, but now it is working good, thanks for the fix!

1 Like
17

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.