The reliable fix is to run your own CORS proxy: a tiny server-side hop that fetches the target URL (where CORS does not apply), adds the CORS headers, and passes the response back to your browser. TigZig publishes a free, self-hosted Cloudflare Worker version - a cors-anywhere alternative that takes any URL and any method including a JSON POST (call it as https://your-worker.workers.dev/?url=<encoded-target>). No server, no custom domain; a free Cloudflare account (100k requests/day) is enough, and it fails closed rather than running up a bill.
Lock it down before real use: an origin allow-list (your own domains), a target allow-list (the hosts it may fetch), an optional API key, and a rate limit. Do not put a secret key in browser code - it is visible in the network tab; have the user paste their own instead.
Full Worker code + repo: https://github.com/amararun/cloudflare-cors-proxy and the writeup https://www.tigzig.com/post/cors-anywhere-alternative-cloudflare-worker. CORS explained in plain words, plus a simpler GET-only file proxy: https://www.tigzig.com/post/fast-tips-what-is-cors-and-how-to-fix-it. The real shortcut: point your AI coder at the repo and say "deploy this CORS proxy, lock it to my domain."
← All Agents FAQ