# Access-Control-Allow-Methods Header — Values & Examples

> Lists the HTTP methods a cross-origin request may use, in the response to a CORS preflight.

Before sending a cross-origin request that isn't 'simple' — a PUT, PATCH or DELETE, a JSON body, or a custom header — the browser sends an OPTIONS preflight asking for permission. The response's Access-Control-Allow-Methods says which methods are allowed. GET, HEAD and POST are always allowed, so they never need listing.

- Type: Response header
- Category: CORS
- Defined in: [Fetch Standard — CORS protocol](https://fetch.spec.whatwg.org/#http-cors-protocol)

## Syntax

```http
Access-Control-Allow-Methods: <method>, <method>…
```

## Examples

```http
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
```

a typical REST API

```http
Access-Control-Allow-Methods: *
```

any method — only for requests without credentials

## Good to know

- Only the preflight (OPTIONS) response needs this header.
- The OPTIONS response must succeed with a 2xx status — a 404 or 405 from your router fails the preflight, whatever the headers say.
- Cache preflight results with `Access-Control-Max-Age: 600` (seconds) to save a round trip on every request.

## How to set Access-Control-Allow-Methods

### Express

```
res.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Allow-Methods", value: "GET, POST, PUT, PATCH, DELETE" }],
      },
    ];
  },
};
```

### nginx

```
add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE" always;
```

### Apache (.htaccess)

```
Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE"
```

## Check it

Fetch only the response headers and filter for Access-Control-Allow-Methods. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^access-control-allow-methods:'
```

## FAQ

### Why is the browser sending an OPTIONS request I never wrote?

That's the CORS preflight. It happens for methods other than GET, HEAD and POST, for Content-Type values other than form or plain text, and for custom headers such as Authorization.

## Status codes it appears with

- [204 No Content](https://www.devkult.com/http/204.md)
- [405 Method Not Allowed](https://www.devkult.com/http/405.md)

## Related headers

- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Tells the browser which origin may read this response from JavaScript running on another site.
- [Access-Control-Allow-Headers](https://www.devkult.com/headers/access-control-allow-headers.md): Lists the request headers a cross-origin request may include, in the response to a CORS preflight.
- [Origin](https://www.devkult.com/headers/origin.md): Sent by browsers to say which origin — scheme, host and port — a request comes from.

## Further reading

- [CORS errors explained](https://www.devkult.com/blog/cors-errors-explained.md)

Open the interactive page: https://www.devkult.com/headers/access-control-allow-methods