What is Cross Origin Resource Sharing (CORS)?

Cross Origin Resource Sharing is a security feature of modern browsers that keeps browser users secure. It prevents malicious activity like cross site scripting. CORS implements headers in the response of any request to the server to say what domains are allowed to make specific types of calls to that server. In SendGrid’s case, we do not allow our customers to make a browser based call to our v3/mail/send endpoint.

Why can’t I send email in my browser application?

When you have a browser-only application that reaches out to APIs, the API key has to be embedded in the application. Anyone with access to a browser-only application can access all of the Javascript source code, including your API keys.

Making your API key publicly accessible could result in anyone authenticating API calls with your API key — this is a significant security concern both for you and SendGrid.

What are some workarounds?

You can create a server based application, which will protect your API keys from being released to the world. Languages like NodeJS, PHP, Ruby, Python, C#, Go, and Java, and others can be implemented to make calls to the API from the security of a locked down server environment.