# CORS error when sending wrong api-key

**URL:** <https://forum.serverless.com/t/cors-error-when-sending-wrong-api-key/14304>\
**Category:** Serverless Framework\
**Created:** [March 8, 2021, 6:37pm UTC](https://forum.serverless.com/t/cors-error-when-sending-wrong-api-key/14304 "2021-03-08T18:37:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chanan](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/chanan/32/4565_2.png) [@chanan](https://forum.serverless.com/u/chanan)\
**Post date:** [March 8, 2021, 6:37pm UTC](https://forum.serverless.com/t/cors-error-when-sending-wrong-api-key/14304/1 "2021-03-08T18:37:23Z")

</div>

Hi,

We have an API that uses x-api-key (private: true) and CORS. Cors works fine in all cases other than when the user sends a bad API key. In that case we observe that the CORS headers are not present. Since the API key is validated by the Gateway and not our code, I am not sure what we can do to fix that. Any suggestions?

---

<div class="post-metadata">

**Author:** ![chanan](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/chanan/32/4565_2.png) [@chanan](https://forum.serverless.com/u/chanan)\
**Post date:** [March 16, 2021, 4:28pm UTC](https://forum.serverless.com/t/cors-error-when-sending-wrong-api-key/14304/2 "2021-03-16T16:28:56Z")

</div>

So I figured out how to set this manually, is there a way to do it from Serverless framework?

 ![Screenshot 2021-03-16 102825](https://canada1.discourse-cdn.com/flex036/uploads/serverless/original/2X/8/87ddd4241c5a648b10f11bbc9f7f246fd40bd7b8.png)