# Getting CORS error while calling okta /v1/token api

**URL:** <https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481>\
**Category:** Questions\
**Created:** [August 11, 2021, 6:46am UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481 "2021-08-11T06:46:30Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![sravan2478](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sravan2478](https://devforum.okta.com/u/sravan2478)\
**Post date:** [August 11, 2021, 6:46am UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/1 "2021-08-11T06:46:30Z")

</div>

Hi,

AM receiving CORS errors while making a POST request OKTA /v1/token api. am testing from my local angular application, I have added my angular localhost url as trusted origin in OKTA but still getting the same error. API is working fine in postman. Any help is greatly appreciated. Please help me.

Thanks,  
Srava

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [August 11, 2021, 4:33pm UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/2 "2021-08-11T16:33:43Z")

</div>

Hi @sravan2478! The token endpoint is not CORS enabled see [Overview | Okta Developer](https://developer.okta.com/docs/guides/enable-cors/overview/#api-support). Here is an example request from the backend - [OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#request-example-2).

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [August 11, 2021, 8:55pm UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/3 "2021-08-11T20:55:52Z")

</div>

@sravan2478 correction this endpoint is CORS enabled for PKCE/SPA apps, but it should not require trusted origins. Can you take a screenshot of the CORS error with the network tab showing the call?

---

<div class="post-metadata">

**Author:** ![sravan2478](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sravan2478](https://devforum.okta.com/u/sravan2478)\
**Post date:** [August 13, 2021, 7:34am UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/4 "2021-08-13T07:34:13Z")

</div>

Thanks a lot Sigama and sorry for late response, I was in other emergency.  
Please note that I have already added my origin to trusted origins. Below are error and api details

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/c/cb08e453ab1483b3483d3596693d31dd25bf9bb3.png)  
 ![image](https://global.discourse-cdn.com/oktadev/original/2X/7/71829676425f444139f170488238e8fe1b01726e.png)  
 ![image](https://global.discourse-cdn.com/oktadev/original/2X/7/7bbc31026481492ed0976edbdcca9934bff9df38.png)

here is my angular code calling the api

getAccessToken() {  
let body = {  
‘grant\_type’: ‘client\_credentials’,  
‘scope’: ‘read’  
};

```
let httpHeaders = new HttpHeaders({
  'Authorization': 'Basic ' + 'MG9hMWZoN29iM2RUOE1VQmc1ZDc6YmI3T3hTTFdfaFhvRmtFRGdEVkhmOXNiTGowZVJfRGRQNkhiQkpKdQ==',
  'accept': 'application/json',
  'cache-control': 'no-cache',
  'content-type': 'application/x-www-form-urlencoded'
});

let options = { headers: httpHeaders };
this.http.post('https://dev-24983211.okta.com/oauth2/default/v1/token', body).subscribe((data: any) => {
  alert(data);
  console.log(data);
}, (err) => {
  console.error(err);
});

```

}

PS: This is my personal okta developer account so am not worried sharing the details here. Please tell me what am doing wrong as this is working fine from postman and .net application.

Thanks,  
Sravan

---

<div class="post-metadata">

**Author:** ![sravan2478](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sravan2478](https://devforum.okta.com/u/sravan2478)\
**Post date:** [August 13, 2021, 7:38am UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/5 "2021-08-13T07:38:13Z")

</div>

At okta end i have created a client\_credentials flow application and am using encoded client\_Id:Client\_secret as authorization key. working fine from postman, am getting access token in response.

---

<div class="post-metadata">

**Author:** ![sravan2478](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sravan2478](https://devforum.okta.com/u/sravan2478)\
**Post date:** [August 13, 2021, 7:56am UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/6 "2021-08-13T07:56:56Z")

</div>

[https://developer.okta.com/docs/reference/api/oidc/#request-example-2](https://developer.okta.com/docs/reference/api/oidc/#request-example-2)

for app integration type SPA we do not have client\_secret, so how do we retrieve access token in SPA? we have client\_id and client\_secret in client\_crendential flow or web or api. How can retrieve this token from angular. please help.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [August 13, 2021, 3:19pm UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/7 "2021-08-13T15:19:55Z")

</div>

Check out the following guide about how to use Authorization Code flow with PKCE, to get tokens for your SPA: [Implement authorization by grant type | Okta Developer](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)

---

<div class="post-metadata">

**Author:** ![sravan2478](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sravan2478](https://devforum.okta.com/u/sravan2478)\
**Post date:** [August 17, 2021, 4:23am UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/8 "2021-08-17T04:23:39Z")

</div>

Thanks Andrea, am aware of Authorization Code flow, my requirement is client credential flow.

---

<div class="post-metadata">

**Author:** ![timfee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/timfee/32/3193_2.png) [@timfee](https://devforum.okta.com/u/timfee)\
**Post date:** [August 17, 2021, 4:00pm UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/9 "2021-08-17T16:00:43Z")

</div>

It looks like this is client side code – so just curious if you’re seeing a “3rd party cookie” alert in the omnibox – I’ve had issues with that from time to time:

 ![Screen Shot 2021-08-17 at 08.51.26](https://global.discourse-cdn.com/oktadev/original/2X/0/0ab502f7e1155fe1fa55c4c8cbce415c50ead834.png)

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 8, 2024, 6:57pm UTC](https://devforum.okta.com/t/getting-cors-error-while-calling-okta-v1-token-api/15481/10 "2024-02-08T18:57:06Z")

</div>