I would highly appreciate if anyone could help me in handling CORS policy for Salesforce Marketing Cloud API requests…

The situation is following: I need to make direct API calls to Marketing Cloud REST endpoints from a web browser, and I don’t want to use any backend server as a proxy for those requests. Obviously, this is currently not possible because of the CORS policy.

So my question is - what can I do to receive the needed ‘Access-Control-Allow-Origin’ header from Marketing Cloud servers? Is there any kind of Whitelist in Marketing Cloud where I can just add my domain so that I can receive this header (I’ve found some in Setup -> Security -> Domain Whitelist but it seems to be something different)?

I was looking for a solution for a while but I didn’t manage to find anything helpful (including this forum).

  • 1
    Using API calls to SFMC from the client-side would be a BAD idea. You'd end up exposing credentials to hackers to play havoc with your account and data. Depending on your use case, you might find WebCollect/DEManager of interest where you can write to Data Extensions and Lists from client-side code. Otherwise, use a proxy, either with a Cloud Page that makes the API calls for you (you'd need SSL installed to serve these with AJAX) or something like Heroku - you get SSL for free. – Macca Jul 7 '19 at 2:09

Not sure if it fits your case or violates performance/security constraints (I'm no developer) but one approach that comes to mind is the following:

  • Create a Marketing Cloud cloud page.
  • Push your request data to the cloud page
  • Read and transform the POST data on the cloud page
  • Use SSJS API functions to interact with the Marketing Cloud REST API.


  • Standard API integration is certainly preferable > last resort approach
  • Every cloud page call costs you a super message > potentially expensive
  • A cloud page is public > security issues

If the developers here think this is stupid or not possible in general, please advise so. I will gladly delete the answer then. ;)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.