Fetch any URL,
without CORS.

CORX is an edge CORS proxy. Prefix any URL and fetch it cross-origin — responses are cached at the edge, rate-limited, guarded against SSRF, and upstream secrets never leave the server.

Try it liveOpen console

No deploy? Use the public key

One prefix: https://corx.envx.cn/fetch?url=https://api.example.com

Try it live

Examples rotate every 10s and load straight through the proxy. Type any URL to take over.

Waiting for the first request…
Auto-rotating examples every 10s

Same as GET https://corx.envx.cn/fetch?url=…. Every request goes through the edge proxy — watch the status, latency, size and cache HIT/MISS badges update as examples rotate.

Use it without deploying

Free to use from your own site with this shared public key: cross-origin GET/HEAD only, daily quotas, best effort. Injection, cache control, subdomain mode and per-key limits need your own deployment.

Public key
corx_wurhkSx9Z5GkXBs85bu8iyqJ-963qATW

Using this key means you accept the terms of use — no phishing, malware, spam, illegal or abusive traffic, and never send credentials through it.

Usage
fetch("https://corx.envx.cn/fetch?url=" + encodeURIComponent(url) + "&corx-key=" + KEY)
Daily limits (UTC)
Per calling site 3000/dayWhole instance 100000/day

Built for real apps, not toy demos

The details that keep secrets, browser callers and debugging under control.

Secrets stay on the edge

Attach variables and header/query rules to a key; corx injects them upstream. The browser never holds the token, and values are masked in the console and logs.

@api.vendor.com
Authorization: Bearer ${TOKEN}

Keyless browser access

Grant an origin to a key and its visitors call the proxy without shipping a key. Grants are per-origin, metered per visitor IP, and logged for audit.

Origin: https://app.example
→ key “web” · no key shipped

Inspect every hop

Run any request through the real pipeline from the console playground — auth, SSRF guards, injection, cache — and read the full response plus a masked injection preview.

200 · MISS · 143 ms
x-corx-target: api.vendor.com

Everything you need at the edge

Simple by design

One URL prefix works from any origin — no SDK, no config, no special headers.

Edge-cached

Responses are cached in R2 and served from the edge, with TTL control, a no-cache escape hatch and per-key policy.

SSRF-safe

Private ranges, DNS rebinding and a D1 blocklist are stopped at the edge — per-key opt-outs for trusted callers.

API keys

Per-key origins, rate limits, cache TTL and keyless grants — revoke any key in one click.

Usage analytics

Requests, traffic, latency and error rates, charted per hour inside the console.

Subdomain mode

Give every target its own host: example.com becomes example-com.your.host.

Media-ready streaming

Large files and Range requests stream straight through — seeking in video and audio just works.

Bilingual console

Manage keys, watch logs, run requests in English or 中文 — with a playground that mirrors the real pipeline.

Yours to self-host

Deploy on your own Cloudflare account with D1 + R2 — no accounts, seats or bills from us.

Ship your first proxy call in 60 seconds

Head to the console, grab an API key, and start fetching.

Open console