---
id: setting-up-cors
title: Setting up Cross-origin resource sharing (CORS)
---

ORY Kratos' Public API supports CORS out of the box. A reference for this
configuration can be found in the
[Configuration Reference](../reference/configuration.md).

For CORS to work properly, we encourage to set the following values:

```yaml
serve:
  public:
    cors:
      enabled: true
      allowed_origins:
        - https://example.org
        - https://*.example.org
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE
      allowed_headers:
        - Authorization
        - Cookie
      exposed_headers:
        - Content-Type
        - Set-Cookie
```
