> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL. > > Documentation indexes by section: > - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt > - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt > - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt > - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt > > Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth > Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks > > OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json > MCP server: https://docusign.docs.buildwithfern.com/_mcp/server # CORS error responses > Learn how to troubleshoot CORS error messages. eSignature REST API 2.1 only When a single-page application (SPA) API request to Docusign cannot be processed, Docusign returns a **403 Forbidden** or **400 Bad Request** error response. An error response is returned if any of the following is true: * **App configuration issues** * The domain where the script is hosted is not one of the [allowed origins](/platform/configure-app#cors-configuration) for the app. * The request did not use one of the [allowed HTTP methods](/platform/configure-app#cors-configuration) for the app. * The [cors scope](/platform/single-page-applications-cors#include-required-scopes-during-authentication) was not specified during authentication. * The request did not include an OAuth access token. * The request is not compatible with eSignature REST API v.2.1. * The API endpoint path did not include /accounts/\{account_id}. * **Account setting issue** The authenticated user’s account does not have CORS [enabled for the app](/platform/single-page-applications-cors/enable-disable-cors). Your app’s error message for this issue should instruct the user to ask their account administrator to enable CORS for the app. This message is appropriate because the other possible error causes would occur during development, not in a production environment. ## Additional error details For some error conditions, the **403 Forbidden** or **400 Bad Request** response is accompanied by detailed error codes and messages. If available, these details appear in the Developer Tools for the browser in which the SPA is running. To see error details, follow these general steps for commonly used browsers, although the exact steps may vary depending on the browser: 1. Launch the browser's Developer Tools. 2. Select the **Network** panel. 3. In the list of API requests, select the request that received the error response. 4. Display the **Response** tab to see the error code and message. This is an example CORS error response displayed in Firefox. ![CORS error message](/_fern-files/_img/54a94d4c651d4eb4a6ca3df50565b1524775397ea3f27dfc4c8659a85d5ae66b.webp) ## General errors This table lists CORS error codes and messages you may see in the browser's Developer Tools when a **403 Forbidden** response is returned, as well as troubleshooting guidance. | Error code | Message | Troubleshooting | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Cors_Invalid_Api_Version` | `Invalid API Version: ensure the request URL contains the correct API version (e.g., >= v2.1) and try again.` | Make sure that the CORS request does not specify an eSignature REST API version earlier than v2.1. See [Formatting API requests](/docs/esign-rest-api/esign101/rules-and-limits/requests) for more information. | | `Http_Method_Not_Allowed` | `Disallowed HTTP Method: ensure the HTTP method being used is one of the supported methods (GET, POST, PUT, DELETE, HEAD) and try again.` | Check the [allowed HTTP methods](/platform/configure-app#cors-configuration) for the app and make sure that the method used in the request is enabled for the app. | | `Insecure_Connection` | `Insecure Connection: ensure the CORS request is made securely (e.g., HTTPS) and try again.` | Make sure that the `origin` header in the CORS request specifies the `https` protocol. In the developer environment, `http` is allowed only if using `localhost` as the origin. All other origins must use `https`. In production, `localhost` is not permitted for origins, and `https` must always be used. | | `Invalid_Account_Id` | `Invalid Account ID: ensure the request URL contains the correct account ID and try again.` | Make sure that the account ID in the CORS request is correct. The account ID appears under **API Account ID** on the [Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=appsAndKeys) page. | | `Invalid_Origin_Header` | `Invalid Origin Header: ensure the request is configured to use CORS and try again.` | Confirm that the value of the `origin` header in the CORS request is an absolute URI starting with `http` or `https`. | | `Misformatted_Account_Id` | `Invalid Account ID: ensure the request URL contains the correct account ID and try again.` | Make sure that the CORS request is not missing the account ID, that the entire ID has been supplied, and that the ID does not contain invalid characters. The account ID appears under **API Account ID** on the [Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=appsAndKeys) page. | | `Missing_Api_Version` | `Invalid API Version: ensure the request URL contains the correct API version (e.g., >= v2.1) and try again.` | Make sure that the CORS request includes the eSignature REST API version 2.1 or greater. See [Formatting API requests](/docs/esign-rest-api/esign101/rules-and-limits/requests) for more information. | | `Missing_Config_Or_Request` | `The request is missing or the account does not have the right permissions. Please check and try again.` | Make sure that CORS is enabled for the integration in the [account-level CORS settings](/platform/single-page-applications-cors/enable-disable-cors). | | `Missing_Cors_Scope` | `Missing CORS Scope: ensure the CORS scope parameter is included in the request and try again.` | The request failed because the `cors` scope was not specified during authentication. The SPA will need to re-authenticate and include the [cors scope](/platform/single-page-applications-cors#include-required-scopes-during-authentication). | | `Origin_Not_Allowed` | `Disallowed Origin Header: ensure the request is configured to use CORS and try again.` | Check the app's [CORS configuration](/platform/configure-app#cors-configuration) and make sure that the request origin is included in the list of origin URLs. | | `Unsupported_Http_Method` | `Unsupported HTTP Method: ensure the HTTP method being used is one of the supported methods (GET, POST, PUT, DELETE, HEAD) and try again.` | Check the [allowed HTTP methods](/platform/configure-app#cors-configuration) for the app and make sure that the method used in the request is enabled for the app. | ## Public Authorization Code Grant errors These errors can occur when an SPA authenticates using [Public Authorization Code Grant](/platform/auth/authcode#public-authorization-code-grant). They will appear in the browser's Developer Tools when a **400 Bad Request** response is returned. | Error code | Message | Troubleshooting | | --------------- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `invalid_grant` | `cors_not_enabled_for_oauth` | Make sure that the **Allow CORS for OAuth calls** setting is enabled in the app's [CORS configuration](/platform/configure-app#cors-configuration). | | `invalid_grant` | `cors_policy_not_setup` | Check the app's [CORS configuration](/platform/configure-app#cors-configuration) and make sure that the request origin is included in the list of origin URLs. | | `invalid_grant` | `invalid_origin` | Confirm that the value of the `origin` header in the CORS request is an absolute URI starting with `http` or `https`. Check the app's [CORS configuration](/platform/configure-app#cors-configuration) and make sure that the request origin is included in the list of origin URLs. | | `invalid_grant` | `origin_required_but_not_included` | Confirm that the CORS request includes a valid `origin` header. | | `invalid_grant` | `unexpected_origin_included` | Returned when non-public SPA clients (such as public native or confidential clients) use CORS and include an origin in the request header. Include an origin only for public SPAs using Public Authorization Code Grant. |