---
title: "CORS preflight for the sandbox approval-token endpoint"
method: OPTIONS
path: "/api/v1/sandbox/auth/approval-token"
tags: ["Sandbox"]
---

# CORS preflight for the sandbox approval-token endpoint

`OPTIONS /api/v1/sandbox/auth/approval-token`

## Request

- Base URL: `https://www.apier.no`
- URL: `https://www.apier.no/api/v1/sandbox/auth/approval-token`
- Auth: none required

Returns 204 with write-side CORS — `Access-Control-Allow-Methods: POST, OPTIONS`; `Access-Control-Allow-Headers: Authorization, Content-Type, Idempotency-Key, X-Correlation-ID`; `Access-Control-Allow-Credentials: false` (Bearer tokens flow cross-origin with credentials=false).: `Authorization` is on Allow-Headers because the sandbox is auth-gated. Max-Age 86400.

## Response `204`

CORS preflight response for the write-side endpoints (`/api/v1/sandbox/auth/approval-token`, `/api/v1/sandbox/actions/plan`, `/api/v1/sandbox/actions/execute`). Differs from `SandboxOptionsPreflight` in four deliberate ways: (1) Allow-Methods is `POST, OPTIONS` not `GET, OPTIONS`; (2) Allow-Headers list includes `Authorization` (sandbox is auth-gated; browser preflights must allow the header or the cross-origin POST fails CORS before the handler runs); (3) `Access-Control-Allow-Credentials: false` is set explicitly (Bearer tokens flow cross-origin with credentials=false; only cookies require credentials=true); (4) Max-Age is 86400 (24h, not 1h) — preflight stable across the entire deploy.

---

[API](https://skmtc.dev/apier/apis/apier-no-api.md) · [All operations](https://skmtc.dev/apier/apis/apier-no-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apier/apis/apier-no-api/revisions/9ec19bc87311?raw)