## The problem
Issue replicate/replicate-javascript#164 (closed, 13 comments): I'm getting a CORS error and it is because I can't go across domains from my domain to yours. Any suggestions? Access to fetch at 'https://api.replicate.com/v1/predictions' from origin 'https://ghostwriter-ai.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
## The fix
You can't call the Replicate API straight from the browser: Replicate doesn't send CORS headers, and that's deliberate, because your API token would be exposed in client-side code (even in packaged apps like Electron or Tauri, TLS traffic can be inspected and the key extracted). The fix is a backend proxy that holds the token - call your own endpoint from the frontend and have the server make the Replicate request. Any serverless function works: Vercel, AWS Lambda, Modal, and so on.
## Notes
Thread: https://github.com/replicate/replicate-javascript/issues/164. Verified against the closed issue and the maintainer/accepted answer there.