I would highly appreciate if anyone could help me in handling CORS policy for Salesforce Marketing Cloud API requests…

The situation is following: I need to make direct API calls to Marketing Cloud REST endpoints from a web browser, and I don’t want to use any backend server as a proxy for those requests. Obviously, this is currently not possible because of the CORS policy.

So my question is - what can I do to receive the needed ‘Access-Control-Allow-Origin’ header from Marketing Cloud servers? Is there any kind of Whitelist in Marketing Cloud where I can just add my domain so that I can receive this header (I’ve found some in Setup -> Security -> Domain Whitelist but it seems to be something different)?

I was looking for a solution for a while but I didn’t manage to find anything helpful (including this forum).

  • 1
    Using API calls to SFMC from the client-side would be a BAD idea. You'd end up exposing credentials to hackers to play havoc with your account and data. Depending on your use case, you might find WebCollect/DEManager of interest where you can write to Data Extensions and Lists from client-side code. Otherwise, use a proxy, either with a Cloud Page that makes the API calls for you (you'd need SSL installed to serve these with AJAX) or something like Heroku - you get SSL for free. – Macca Jul 7 '19 at 2:09

Not sure if it fits your case or violates performance/security constraints (I'm no developer) but one approach that comes to mind is the following:

  • Create a Marketing Cloud cloud page.
  • Push your request data to the cloud page
  • Read and transform the POST data on the cloud page
  • Use SSJS API functions to interact with the Marketing Cloud REST API.


  • Standard API integration is certainly preferable > last resort approach
  • Every cloud page call costs you a super message > potentially expensive
  • A cloud page is public > security issues

If the developers here think this is stupid or not possible in general, please advise so. I will gladly delete the answer then. ;)

  • Agree on the solution. Additionally, you should be using JSON code resources, instead of a Cloud Page. This will first of all not consume super messages, and additionally response headers will have the correct value for what is preferred in an integration context (application/json) – Lukas Lunow Apr 29 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.