CORX vs corsproxy.io
Last checked 2026-09-17
corsproxy.io: Website · Documentation
Both are CORS proxies, and both will unblock a browser request. The difference is what happens to the upstream credential: corsproxy.io is a hosted service you sign up for, CORX is a Worker you deploy whose point is holding an API key the browser never sees.
See it live: run a real injection from the landing demo.
Test any URL's CORS in your browser
| Topic | CORX | corsproxy.io |
|---|---|---|
| Auth model | Per-key (`X-Api-Key` or Bearer), keyless access for granted origins, or a hosted instance's shared public key. Keys are stored as hashes in your own D1. | Account and API key on every call (`?key=…`), the free tier included; domain authorization on paid plans. |
| Upstream secrets | Header and query rules live in D1 — AES-256-GCM ciphertext when `INJECTION_KEK` is set — and are applied server-side, only on the hosts the key allows. The browser never receives the value. | No server-side secret store. Header overrides are query parameters (`reqHeaders=authorization:Bearer TOKEN`), so the value comes from the caller — their own FAQ says to keep upstream secrets out of browser code. |
| Self-hosting | MIT, one Cloudflare Worker with D1 and R2, deployed to your own account; the free plan covers small deployments. | Closed source, hosted only: there is no self-host path. |
| Caching | R2 GET cache, adjusted per request with `corx-ttl` / `corx-no-cache` and capped per key; keys that inject request headers never share it, and a key's resolved response header rules are part of the cache key. | Edge cache with a 1-hour default TTL; `ttl=` overrides need the Production plan, and the cache is per data centre rather than global. |
| Request logging | Every request lands in your D1 — target, host, status, latency, caller origin, key, IP, country. The raw window is yours to set (30 days by default, `LOG_RETENTION_DAYS`) and logging can be switched off entirely (`LOG_REQUESTS=false`); the daily aggregate keeps the trend. | Their privacy policy lists the requested URL, user agent, IP, timestamps and request counts, plus your account email. Bodies and headers are not logged. |
| Limits | Your own per-key rate limits and daily quotas, or the shared public tier's. Self-hosted, the ceiling is your Cloudflare plan. | Free: 10,000 requests + 1 GB per month, 1 MB files, browser requests only. Hobby $5: 250k requests + 25 GB. Production $29: unlimited* requests, 1 GB files. |
| Price | Free and MIT-licensed. You pay Cloudflare for what the Worker serves; there is no subscription and no seat count. | $0 free tier, $5 Hobby, $29 Production per month — and free unlimited for open-source and educational projects on request. |
| Time to first request | Deploy a Worker to your own account (about ten minutes), or copy a hosted instance's public key and send GET/HEAD inside its daily quota. | Create an account, prefix the URL, done: no deployment and no infrastructure to own.They win this rowAccepted trade-off |
| Beyond proxying | Proxying only: fetch, cache, inject, log, response header rules (strip `X-Frame-Options` / CSP for hosts you control), text re-encoding (`corx-charset`) and a JSON envelope (`corx-wrap`), plus a public CORS tester. No image transforms, scraping or file conversion. | Image transformations (beta), a web-scraping API, header rewrites and file conversion on the paid plans.They win this rowAccepted trade-off |
| Availability | Self-hosted: as available as your own Cloudflare account. The public instance is best-effort, with no SLA and no support commitment. | 99.9% monthly uptime commitment on Hobby, 99.99% on Production; the free tier is best-effort with no SLA.They win this rowAccepted trade-off |
Where corsproxy.io wins
If your browser app has no secret to hide, corsproxy.io is the lower-effort choice: no deployment, a free tier, a support address, an uptime commitment on paid plans and extras like image transforms and a scraping API. When CORX's secret injection is not what you need, their hosted plan is simply less to run.
Sources
Every corsproxy.io cell above comes from their own documentation, read on the date shown — follow the links and check them. The CORX column describes this repository (README.md and FEATURES.md) and the same day's code.
- https://corsproxy.io/ (Last checked 2026-09-17)
- Auth model: The homepage's own fetch sample carries `?key=YOUR_API_KEY`, and its FAQ answers "How do I get an API key?" with creating a free account.
- Self-hosting: No repository, source download or self-host path is linked anywhere on the site or in the docs.
- Time to first request: The documented path is: create an account, copy the key, prefix the URL. Nothing to deploy, nothing to operate.
- https://corsproxy.io/docs/header-rewrites/ (Last checked 2026-09-17)
- Upstream secrets: Header overrides are query parameters (`reqHeaders=authorization:Bearer%20TOKEN`), so the value comes from the caller; the homepage FAQ advises against exposing upstream secrets in browser code.
- https://corsproxy.io/docs/dynamic-cache/ (Last checked 2026-09-17)
- Caching: Default 1-hour TTL for GET/HEAD, `ttl=` overrides require the Production plan, and the cache is per data centre rather than global.
- https://corsproxy.io/privacy/ (Last checked 2026-09-17)
- Request logging: Collects the requested URL, user agent, IP, timestamps and request counts plus the account email; states that bodies and headers are not logged.
- https://corsproxy.io/pricing/ (Last checked 2026-09-17)
- Limits: Free: 10,000 requests + 1 GB per month, 1 MB files, browser requests only (no server-side requests, no Production features). Hobby: 250k requests + 25 GB. Production: unlimited requests, 1 GB files.
- Price: Free / Hobby $5 / Production $29 per month, plus a free unlimited plan for open-source and educational projects on request.
- Beyond proxying: Lists image transformations (beta), header rewrites, an advanced cache and a web-scraping API as plan features.
- Availability: 99.9% monthly uptime commitment on Hobby, 99.99% on Production; the free tier is best-effort with no SLA.
- CORX's own column: README.md · FEATURES.md
Both are about a line of code away. Try the public key on the landing page first, and self-host when the traffic matters. Back to the landing page