APIs, auth & CORS

You click login, your app calls an API — and the browser blocks it, the server says 401, or you're logged out again thirty seconds later. APIs, auth, and CORS errors look cryptic, but they usually mean one of a few things: the browser isn't allowed to ask, the key or token isn't what the server expects, or your session isn't being saved. This section shows you how to check which one it is, in the right order, before you start changing code at random.

Common culprits: CORS blocks, expired or missing API keys, tokens sent in the wrong format, cookies blocked between sites, redirect URLs that don't match your auth settings, and clock or session expiry problems.

• 401 Unauthorized from the OpenAI API (invalid_api_key)

  A 401 from OpenAI means the key itself was rejected — wrong, damaged, revoked, or from another project. Verify or regenerate it, keep it server-side only, and test it directly before changing code.

• Access to fetch has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header

  Blocked by CORS policy with no Access-Control-Allow-Origin header? The fix is on the API server — set the header, handle preflight, or proxy through your own origin.