Fire a real preflight OPTIONS request from a global edge server. See what Access-Control headers the server returns and whether your API allows cross-origin requests.
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls which websites can make JavaScript requests to your API. When a browser detects a cross-origin request, it first sends a preflight OPTIONS request to ask the server if the real request is allowed. The server’s response headers (particularly Access-Control-Allow-Origin) determine whether the browser proceeds or blocks the request.
This tool fires that preflight from Cloudflare’s global edge, so you can inspect the exact headers your server returns without needing a running frontend. Common issues: missing Access-Control-Allow-Origin, wildcard origin with Allow-Credentials: true (browsers reject this), or a preflight returning 4xx instead of 200/204.