A CORS error names the response the browser refused to expose, so find that request first. Fillo's public endpoints for reading and submitting published forms allow browser origins — code sync, private management calls, and browser-direct storage each have different boundaries.
Classify the request
| Request | Expected browser behavior |
|---|---|
| Load or submit a published form | Allowed from browser origins |
Sync a code-defined schema with a pk_ key | Subject to workspace sync policy and allowed origins |
Call the Management API with an fsk_ key | Server-side only, with no browser CORS contract |
| Upload directly to S3 | Controlled by the bucket's CORS configuration |
| Upload directly to Google Drive or Box | Uses the signed provider flow created by Fillo |
If a public request shows up as a CORS failure, check its URL and status. A proxy, deployment rewrite, HTML error page, redirect, or wrong API origin can leave out the expected headers even though the endpoint itself supports browsers.
Fix a code sync origin denial
The developer console can report sync_origin_denied when a publishable-key sync comes from an origin that isn't on the workspace allowlist.
- Open Settings > Developers.
- Check whether publishable-key staging is enabled.
- Add the exact application origin, including scheme and non-default port when present.
- Don't include a page path or query string.
- Reload from that origin and try again.
For stricter production control, keep the workspace on authenticated-only staging and push reviewed schemas with the CLI or a server sync token. A public key never publishes a staged change live.
Keep management credentials on the server
Don't work around a Management API CORS failure by standing up a public proxy that forwards arbitrary requests. Put the fsk_ key in a server-only environment variable, validate the operation in your backend, and call Fillo from there.
Configure S3 separately
An S3 upload goes straight from the respondent's browser to your bucket. Allow your actual form origins, the required multipart methods, and the provider-required headers in the bucket policy. Fillo can't add a missing bucket CORS rule at request time.
Related
- File upload was rejected: Separate storage CORS from file validation.
- API reference: Choose the public or server-side endpoint for the job.
- CLI: Stage code-defined forms without browser sync access.