> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Cross-Origin Resource Sharing (CORS)

> **Warning**
>
> Developing with the CLM API is only available for CLM customers with a production account. To purchase a plan to gain access to the CLM API, contact [Docusign Sales](https://www.docusign.com/contact-sales).

[Cross-Origin Resource Sharing](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) (CORS) refers to the ability to access a normally-restricted resource via JavaScript in a browser. By default, a browser will not allow POST, PATCH, and DELETE requests via JavaScript to a domain that did not originally serve the page.

Writing browser-based JavaScript applications or uploading and downloading documents to and from Docusign CLM from a browser can be helpful. CLM supports CORS requests for the Object, Task, and Content APIs for allowed domains for this reason.

> **Note**
>
> For more information on how CORS is implemented for eSignature and other APIs, see [Single-page applications and CORS](/platform/single-page-applications-cors).

To allow an origin domain for cross-domain requests, the origin domain must be allowed for the CLM account being accessed. In CLM Preferences, navigate to **Manage Domains** and add the domain that will serve the web pages that will access the API. You can use wildcards in the domains that you specify.

**Best Practice**: Only add the domains that are necessary, and use wildcards sparingly.