Access-Control-Allow-Credentials Header Explained

What the HTTP Access-Control-Allow-Credentials header does and when it's used.

Published October 15, 2026

The Access-Control-Allow-Credentials header indicates whether the response can be shared when credentials (cookies, auth headers) are included.

Key points

Must be set to "true" for cross-origin requests using cookies to succeed, and can't be combined with a wildcard origin