# CORS origin problem

**URL:** <https://devforum.okta.com/t/cors-origin-problem/12844>\
**Category:** Questions\
**Created:** [February 9, 2021, 7:16am UTC](https://devforum.okta.com/t/cors-origin-problem/12844 "2021-02-09T07:16:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![artash.mardoyan](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@artash.mardoyan](https://devforum.okta.com/u/artash.mardoyan)\
**Post date:** [February 9, 2021, 7:16am UTC](https://devforum.okta.com/t/cors-origin-problem/12844/1 "2021-02-09T07:16:01Z")

</div>

We have a problem with the integration of Use PKCE (for public clients) on Single Page Application(React).

We did the steps described.  
[PKCE integration overview](https://developer.okta.com/docs/guides/implement-auth-code-pkce/overview/)

After the redirection from OKTA sign-in page to our callback route(on REACT app).  
We successfully get code and state from OKTA’s query params.  
[OKTA’s callback URL](http://localhost:3000/implicit/callback?code=4-IdYHWXVEqGxM9NKWKWZyfo5iEHEq5_RaQpQc%5B%E2%80%A6%5DrUtL1cfqEGivllht0QEFYaHljStIG6eRPbxlXAOHM0au3fVc3jRC3FiywSEPC).

But when trying to exchange the code from the callback URL for tokens we get CORS ERROR.  
[\> Exchange code for tokens](https://developer.okta.com/docs/guides/implement-auth-code-pkce/exchange-code-token/).

We added our app URL ([http://localhost:3000](http://localhost:3000)) to TRUSTED ORIGINS but still get the same problem.

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [February 9, 2021, 3:32pm UTC](https://devforum.okta.com/t/cors-origin-problem/12844/2 "2021-02-09T15:32:17Z")

</div>

Are you exchanging your code for tokens manually, or using our React SDK? I published a video this morning that shows how to use our Okta CLI to create a React app that uses PKCE. The Okta CLI configures everything for you, including trusted origins. Maybe it’ll help?

[![](https://img.youtube.com/vi/V3G8-nfWQoM/maxresdefault.jpg "React + Okta CLI") ](https://www.youtube.com/watch?v=V3G8-nfWQoM)

---

<div class="post-metadata">

**Author:** ![artash.mardoyan](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@artash.mardoyan](https://devforum.okta.com/u/artash.mardoyan)\
**Post date:** [February 10, 2021, 7:52am UTC](https://devforum.okta.com/t/cors-origin-problem/12844/3 "2021-02-10T07:52:58Z")

</div>

We integrated OKTA react SDK in our existing(LIVE) application.  
But for exchanging code for tokens we use a manual way  
[Exchange the code for tokens]  
([Exchange the code for tokens | Okta Developer](https://developer.okta.com/docs/guides/implement-auth-code-pkce/exchange-code-token/)).

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 26, 2024, 6:50pm UTC](https://devforum.okta.com/t/cors-origin-problem/12844/4 "2024-01-26T18:50:41Z")

</div>