# cors.tools

Public, no login, no API key, no rate limits.
API contract: https://cors.tools/openapi.json
HTML documentation: https://cors.tools/docs
Discovery: https://cors.tools/sitemap.xml
All APIs allow cross-origin requests. Errors: {"error":{"code":400,"message":"..."}}.
Use POST JSON or application/x-www-form-urlencoded for mutations. GET creation is also supported.
Save delete_token returned by paste/link creation. POST /api/pastes/{id}/delete or /api/links/{id}/delete with {"delete_token":"..."}. Never share deletion tokens.
GET /proxy?url=<encoded URL> or /https://example.com forwards GET. /proxy also supports POST, PUT, PATCH, DELETE and HEAD with the original body. Client Authorization/Cookie are stripped; opt in via X-Upstream-Authorization/X-Upstream-Cookie. GET or POST /read with url, format=markdown|text|json, render=true for JavaScript pages. Proxy limits: 5 MiB input, 10 MiB output, 5 redirects, 20 seconds. Extraction limits: 5 MiB HTML. No anti-bot bypass.