# Cross-Origin-Embedder-Policy Header — Values & Examples

> Requires the resources a page loads to opt in to being embedded — the second half of cross-origin isolation.

With `require-corp`, a page can only load cross-origin resources that explicitly allow it, through CORS or a `Cross-Origin-Resource-Policy` header. Combined with `Cross-Origin-Opener-Policy: same-origin`, that makes the page cross-origin isolated, which unlocks `SharedArrayBuffer` and high-resolution timers — needed by multithreaded WebAssembly apps such as ffmpeg.wasm.

- Type: Response header
- Category: Security
- Defined in: [HTML Standard — Cross-origin embedder policies](https://html.spec.whatwg.org/multipage/browsers.html#coep)

## Syntax

```http
Cross-Origin-Embedder-Policy: unsafe-none | require-corp | credentialless
```

## Values

| Value | Meaning |
|---|---|
| `unsafe-none` | the default: no restrictions |
| `require-corp` | cross-origin resources must opt in with CORS or CORP |
| `credentialless` | cross-origin no-cors requests are sent without cookies instead of being blocked |

## Examples

```http
Cross-Origin-Embedder-Policy: require-corp
```

strict; every cross-origin resource must opt in

```http
Cross-Origin-Embedder-Policy: credentialless
```

easier with third-party images and scripts that don't send CORP

## Good to know

- Run `self.crossOriginIsolated` in the console to confirm isolation is on.
- Third-party embeds — ads, video iframes, analytics pixels — often break under `require-corp`. `credentialless` avoids much of that; check browser support for your audience.
- Test first with `Cross-Origin-Embedder-Policy-Report-Only`.

## How to set Cross-Origin-Embedder-Policy

### Express

```
res.set("Cross-Origin-Embedder-Policy", "require-corp");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Cross-Origin-Embedder-Policy", value: "require-corp" }],
      },
    ];
  },
};
```

### nginx

```
add_header Cross-Origin-Embedder-Policy "require-corp" always;
```

### Apache (.htaccess)

```
Header always set Cross-Origin-Embedder-Policy "require-corp"
```

## Check it

Fetch only the response headers and filter for Cross-Origin-Embedder-Policy. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^cross-origin-embedder-policy:'
```

## FAQ

### How do I enable SharedArrayBuffer?

Serve the page over HTTPS with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless). self.crossOriginIsolated then returns true.

## Related headers

- [Cross-Origin-Opener-Policy](https://www.devkult.com/headers/cross-origin-opener-policy.md): Isolates your page from cross-origin windows that open it or that it opens.
- [Cross-Origin-Resource-Policy](https://www.devkult.com/headers/cross-origin-resource-policy.md): Says which sites may load this resource through plain tags like <img> and <script>.
- [Content-Security-Policy](https://www.devkult.com/headers/content-security-policy.md): Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.

Open the interactive page: https://www.devkult.com/headers/cross-origin-embedder-policy