CORS Configuration

The cors option on defineApiConfig controls CORS for the GraphQL route. The Hono layer that wraps the GraphQL server applies it.

1
2
3
4
5
6
7
8
9
const server = defineApiConfig({
  runtime,
  tokenResolver,
  cors: {
    origin: "https://app.example.com",
    credentials: true,
  },
})

The option shape is Hono's CORS middleware config, with origin, allowMethods, allowHeaders, credentials, and so on.

Default #

When cors is omitted, CORS is not enabled. The GraphQL route is same-origin only, and no Access-Control-Allow-Origin header is sent. Set origin to opt in.