# Access-Control-Allow-Credentials Header — Values & Examples

> Allows a cross-origin page to read a response to a request made with cookies or HTTP authentication.

By default, cross-origin `fetch` doesn't send cookies, and a response to a request with credentials is hidden unless the server sends this header. Credentials need both halves: the client opts in with `credentials: "include"` (or `withCredentials` in XHR and axios), the server answers with `Access-Control-Allow-Credentials: true` and an exact origin.

- Type: Response header
- Category: CORS
- Defined in: [Fetch Standard — CORS protocol](https://fetch.spec.whatwg.org/#http-cors-protocol)

## Syntax

```http
Access-Control-Allow-Credentials: true
```

## Examples

```http
Access-Control-Allow-Credentials: true
```

the only valid value; omit the header otherwise

## Good to know

- With credentials, `Access-Control-Allow-Origin`, `-Methods` and `-Headers` can't be `*` — use explicit values.
- Third-party cookies also need `SameSite=None; Secure`, and some browsers block them regardless.
- Only enable this for origins you trust: they can make authenticated requests as your users and read the answers.

## How to set Access-Control-Allow-Credentials

### Express

```
res.set("Access-Control-Allow-Credentials", "true");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Allow-Credentials", value: "true" }],
      },
    ];
  },
};
```

### nginx

```
add_header Access-Control-Allow-Credentials "true" always;
```

### Apache (.htaccess)

```
Header always set Access-Control-Allow-Credentials "true"
```

## Check it

Fetch only the response headers and filter for Access-Control-Allow-Credentials. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^access-control-allow-credentials:'
```

## FAQ

### Why aren't my cookies sent on a cross-origin fetch?

fetch only sends them with credentials: 'include'. The cookie must also have SameSite=None and Secure, and the server must reply with Access-Control-Allow-Credentials: true and an exact Access-Control-Allow-Origin.

## Related headers

- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Tells the browser which origin may read this response from JavaScript running on another site.
- [Set-Cookie](https://www.devkult.com/headers/set-cookie.md): Stores a cookie in the browser, with attributes that control its lifetime, scope and security.
- [Cookie](https://www.devkult.com/headers/cookie.md): Sends the cookies the browser has stored for this site back to the server.
- [Origin](https://www.devkult.com/headers/origin.md): Sent by browsers to say which origin — scheme, host and port — a request comes from.

## Further reading

- [CORS errors explained](https://www.devkult.com/blog/cors-errors-explained.md)
- [SameSite cookies explained](https://www.devkult.com/blog/samesite-cookies-explained.md)

Open the interactive page: https://www.devkult.com/headers/access-control-allow-credentials