Trusted Origins

Authorize browser origins to upload to your buckets and read from signed or CDN URLs. Without trusted origins, only the Koolbase dashboard can make these requests from a browser.

Why this exists

Browsers enforce CORS (Cross-Origin Resource Sharing) when a page hosted at one origin makes requests to another. When your app at https://app.mycompany.com tries to upload a file to Koolbase storage, the browser first asks Koolbase whether that origin is allowed. If the answer's no, the request is blocked before it even leaves the browser.

Trusted Origins is the project-scoped allowlist that answers that question. Add your app's origin and uploads, downloads via signed URLs, and fetch() calls against your CDN URLs from that origin all succeed.

When you don't need this

Native mobile apps (iOS, Android), server-side code, and any non-browser HTTP client don't trigger CORS — they make requests directly without the preflight check. Trusted Origins only matters when a browser is involved.

Adding an origin

Open your project in the Koolbase dashboard
Click Storage in the sidebar
Click the Trusted Origins button at the top of the page
Enter your origin in the form (e.g. https://app.example.com) and click Add

The origin is live across both private and public storage within seconds. No restart, no rebuild — your app can immediately make CORS requests from that origin.

Origin format

An origin is scheme://host[:port] with no path, query, or fragment. Some valid examples:

https://app.example.com
http://localhost:3000
https://staging.mycompany.com:8443

And some things the dashboard will reject:

https://app.example.com/dashboard   # contains a path
https://*.example.com                # wildcards not supported
example.com                          # missing scheme
https://app.example.com/             # trailing slash

Scope

Trusted Origins are project-scoped. An origin you add to one project doesn't apply to another. If your company has both a staging and a production project on Koolbase, configure trusted origins on each.

Within a project, the allowlist applies to the API and all buckets, private and public. A browser app on a trusted origin can sign in, read and write records, call functions and upload — everything a phone can, except code push and offline sync. Per-bucket origin lists aren't currently supported.

Find the page under Configuration → Trusted Origins in the dashboard. It used to live under Storage, when it governed only buckets; the old link redirects.

Removing an origin

Click the trash icon next to any origin on the Trusted Origins page and confirm. Browser requests from that origin will start failing CORS within seconds — the change is live as soon as the confirmation dialog disappears.

The Koolbase dashboard always works

https://app.koolbase.com is included automatically and can't be removed. You won't lock yourself out of your own dashboard by clearing every customer-added origin.

Troubleshooting

“Failed to fetch” or CORS errors in the browser console

Check that the origin you added matches the one in your browser's URL bar exactly. https://app.example.com and https://www.app.example.com are different origins — both need to be added if your app serves from both.

Works on production, fails on localhost

Add http://localhost:3000 (or whatever port your dev server uses) as a trusted origin. http schemes are accepted for development; production origins should use https.

Changes don't seem to take effect

Browsers cache CORS preflight responses for up to an hour by default. If you just added an origin but your app still hits CORS errors, try a hard refresh (Cmd+Shift+R / Ctrl+Shift+F5) to bypass the preflight cache.

Download & Delete

Image Transforms