Anthropic API · sdk · fg-0472
Calling the Claude API from the browser fails with a CORS error or a browser-like environment error
It looks like you're running in a browser-like environment. This is disabled by default, as it risks exposing your secret API credentials to attackers.
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
The TypeScript SDK refuses to run in a browser unless dangerouslyAllowBrowser is set, and the API grants cross-origin requests only when the anthropic-dangerous-direct-browser-access header is present, which that option adds.
Fix
Call the API from a server route and keep the key there. Only for bring-your-own-key tools where the user supplies their own key, set dangerouslyAllowBrowser true.
Apply
const client = new Anthropic({ apiKey: userSuppliedKey, dangerouslyAllowBrowser: true }); // raw fetch: add header 'anthropic-dangerous-direct-browser-access': 'true'Affects: @anthropic-ai/sdk 0.27.0 and later, as of 2026-10
Sources
- https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/typescript
- https://github.com/anthropics/anthropic-sdk-typescript/issues/248
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp