I would highly appreciate if anyone could help me in handling CORS policy for Salesforce Marketing Cloud API requests…

The situation is following: I need to make direct API calls to Marketing Cloud REST endpoints from a web browser, and I don’t want to use any backend server as a proxy for those requests. Obviously, this is currently not possible because of the CORS policy.

So my question is - what can I do to receive the needed ‘Access-Control-Allow-Origin’ header from Marketing Cloud servers? Is there any kind of Whitelist in Marketing Cloud where I can just add my domain so that I can receive this header (I’ve found some in Setup -> Security -> Domain Whitelist but it seems to be something different)?

I was looking for a solution for a while but I didn’t manage to find anything helpful (including this forum).

  • 2
    Using API calls to SFMC from the client-side would be a BAD idea. You'd end up exposing credentials to hackers to play havoc with your account and data. Depending on your use case, you might find WebCollect/DEManager of interest where you can write to Data Extensions and Lists from client-side code. Otherwise, use a proxy, either with a Cloud Page that makes the API calls for you (you'd need SSL installed to serve these with AJAX) or something like Heroku - you get SSL for free.
    – Macca
    Commented Jul 7, 2019 at 2:09
  • Came here because of the CORS issue. Then you reminded me about DEManager. An oldie but a goodie. Commented Mar 24, 2023 at 23:50

1 Answer 1


Not sure if it fits your case or violates performance/security constraints (I'm no developer) but one approach that comes to mind is the following:

  • Create a Marketing Cloud cloud page.
  • Push your request data to the cloud page
  • Read and transform the POST data on the cloud page
  • Use SSJS API functions to interact with the Marketing Cloud REST API.


  • Standard API integration is certainly preferable > last resort approach
  • Every cloud page call costs you a super message > potentially expensive
  • A cloud page is public > security issues

If the developers here think this is stupid or not possible in general, please advise so. I will gladly delete the answer then. ;)

  • Agree on the solution. Additionally, you should be using JSON code resources, instead of a Cloud Page. This will first of all not consume super messages, and additionally response headers will have the correct value for what is preferred in an integration context (application/json) Commented Apr 29, 2021 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .