Fetch any URL,
without CORS.
CORX is an edge CORS proxy. Prefix any URL and fetch it cross-origin — responses are cached at the edge, rate-limited, guarded against SSRF, and upstream secrets never leave the server.
One prefix: https://corx.envx.cn/fetch?url=https://api.example.comNo deploy? Use the public key
Try it live
Examples rotate every 10s and load straight through the proxy. Type any URL to take over.
Same as GET https://corx.envx.cn/fetch?url=…. Every request goes through the edge proxy — watch the status, latency, size and cache HIT/MISS badges update as examples rotate.
Using React, Vue, axios or ky? Copy-paste snippetsTest a URL's CORS
Use it without deploying
Free to use from your own site with this shared public key: cross-origin GET/HEAD only, daily quotas, best effort. Injection, cache control, subdomain mode and per-key limits need your own deployment.
Using this key means you accept the terms of use — no phishing, malware, spam, illegal or abusive traffic, and never send credentials through it.
A host this instance blocks outright answers 403 whatever the quotas say — the list is public.
Built to be read by agents
This instance describes itself in llms.txt, so a coding agent can pick up the calling conventions, auth tiers, caching and limits in one fetch instead of reading the site.
Also generated for this host: robots.txt · sitemap.xml
Built for real apps, not toy demos
The details that keep secrets, browser callers and debugging under control.
Secrets stay on the edge
Attach variables and header/query rules to a key and CORX injects them upstream, scoped per target host — so one key can hold a different credential for each vendor. A variable you expose can be referenced by the page as `${NAME}` without the value ever reaching the browser; values are masked in the console and logs.
Keyless browser access
Grant an origin to a key and its visitors call the proxy without shipping a key. Grants are per-origin, metered per visitor IP, and logged for audit.
Inspect every hop
Run any request through the real pipeline from the console playground — auth, SSRF guards, injection, cache — and read the full response plus a masked injection preview.
A console, not just an endpoint
Most self-hosted proxies hand you a URL and stop there. CORX ships the product around it: a bilingual dashboard for usage and a period-over-period trend, per-key policy, request logs, a host blocklist and a playground that runs through the real pipeline.
You trust someone. Choose who.
A CORS proxy is a man in the middle by design: whoever runs it can read, change and replay everything that passes through. CORX does not hide that. It is built so the honest answer to “can I trust it?” is not “yes” — it is “you don't have to”.
The hosted instance — free, public, best-effort
A shared demo of the public tier: no sign-up, daily quotas, revocable without notice. Fine for public data, demos and prototypes — not for secrets, credentials or private data. The public tier strips Cookie and Authorization, serves from a shared cache and logs requests for 30 days; those reduce exposure, they are not a guarantee.
Your own deployment — free, private
One MIT-licensed Cloudflare Worker with D1 + R2. Deploy it to your own account on the free tier and the whole data path stays inside it: your keys, your logs, your limits, no third party in the middle. Read the source, fork it, change it — that is the point.
One click: Cloudflare clones the repository to your GitHub, creates the D1 database and R2 bucket in your account, and deploys it — the free plan is enough.
No accounts, seats or bills from us. Where trust matters, self-hosting is the intended way to run CORX.
Everything you need at the edge
Simple by design
One URL prefix works from any origin — no SDK, no config, no special headers.
Edge-cached
Responses are cached in R2 and served from the edge, with TTL control, a no-cache escape hatch and per-key policy.
SSRF-safe
Private ranges, DNS rebinding and a D1 blocklist are stopped at the edge — per-key opt-outs for trusted callers.
API keys
Per-key origins, rate limits, cache TTL and keyless grants — revoke any key in one click.
Usage analytics
Requests, traffic, latency and error rates, charted per hour inside the console.
Subdomain mode
Give every target its own host: example.com becomes example-com.your.host.
Media-ready streaming
Large files, Range requests and SSE (LLM chat APIs) stream straight through — seeking in video and audio just works, and tokens arrive as they are generated.
Bilingual console
Manage keys, watch logs, run requests in English or 中文 — with a playground that mirrors the real pipeline.
Yours to self-host
Deploy on your own Cloudflare account with D1 + R2 — no accounts, seats or bills from us.
CORX FAQ
The questions a proxy has to answer before it sees production traffic.
What is CORX?
CORX is an open-source CORS proxy that runs on Cloudflare's edge. Prefix any URL with /fetch?url= and the response comes back with CORS headers, so browser code can read APIs that never set them — with R2 edge caching, rate limiting and SSRF guards built in.
How do I call it?
Four equivalent shapes: /fetch?url=<encoded>, /proxy/<url>, /<url> (path style), or subdomain mode where api.example.com becomes api-example-com.<your zone>. GET and HEAD are cached; every other method passes straight through uncached.
Do I need an API key?
Not for this hosted instance: copy the public key from this page and send GET/HEAD requests within its daily quotas. Your own deployment can use per-caller keys, keyless access for granted origins, or no auth at all behind its own network.
Can I send cookies, tokens or personal data?
Not through the public key: it strips Cookie and Authorization before forwarding, responses may be served from a shared cache, and requests are logged for 30 days. Keep private or authenticated traffic on your own deployment.
What happens when I hit the limits?
You get 429 — the daily quota carries a Retry-After header, the per-minute rate limit is a plain 429. Requests are counted per calling site, per target host and per instance, plus a per-minute rate limit; cached responses count toward the daily quotas — the quota is about requests, not upstream load.
Can I self-host it?
Yes. CORX is MIT-licensed TypeScript for Cloudflare Workers, D1 and R2: deploy it to your own account and the quotas, limits and logs are yours. The repository README covers the whole deployment.
Can I trust the hosted instance with my traffic?
Only with data you would hand to a stranger. A proxy sees — and can change — everything passing through it, and on a hosted instance the operator is that stranger. Use the public key for public data, demos and prototypes; when the traffic matters, self-host CORX and the only operator left in the path is you.
Does CORX come with an admin console?
Yes — a bilingual (English/中文) console with a usage dashboard and a period-over-period trend, per-key policy (rate limits, allowed origins, cache TTL, keyless grants, upstream injection, public-tier quotas), request logs, a host blocklist and a playground that runs requests through the real pipeline. Most self-hosted proxies are just a fetch endpoint; this is the product around it, in the same Worker.
Is CORX free?
Yes, both halves. The hosted instance gives you a public key with no account — GET/HEAD, daily quotas, best effort. Self-hosting is free too: CORX is MIT-licensed and runs on Cloudflare's free plan; if you outgrow that you pay Cloudflare ($5/mo Workers Paid), not us. There is no paid tier, no seat count and no subscription.
Comparing it with another hosted proxy? corsproxy.io · Corsfix · AllOrigins
Ship your first proxy call in 60 seconds
Head to the console, grab an API key, and start fetching.
Open console