HTTP headers / response header

Access-Control-Allow-Headers

Access-Control-Allow-Headers: Authorization, Content-Type

What it does

Preflight answer: which request headers the cross-origin caller may send.

The gotcha

Any custom header (X-Api-Key, X-Request-Id…) must be listed or the browser blocks the real request — the error message names the missing one.

Debugging headers on a phone

The fastest way to see what Access-Control-Allow-Headers is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · WWW-Authenticate · Content-Encoding · Transfer-Encoding · ETag · Last-Modified · Expires

Inspect Access-Control-Allow-Headers on a live request.

Build the request, send it, read raw headers and timing — from your iPhone. Free to start.

Download on the App Store