CORS

CORS is your browser asking another origin if this page may call it.

Cross-Origin Resource Sharing. The name is worse than the rule. Your frontend on http://localhost:3000 asks http://localhost:3001 for data. Those are two origins. The browser checks with the API first. If the API does not send the right headers, the tab hides the response. The server may have been fine. The browser is being a parent.

The tell

The same fetch from the CLI or an agent works. No browser, no check. If the terminal is green and the tab is red, it is almost always this.

This exists so a random site in one tab cannot quietly call your bank in another tab, riding a cookie you already have. The error sounds like you committed a crime. You did not. You crossed origins.

Fix the side you own

If the builder split frontend and backend, allow your real origins on the server: localhost in dev, the deploy URL in prod. Do not paste * next to credentials. A wildcard plus cookies is how you undo the protection.

If you do not own the other API, stop calling it from the browser. Route through your backend. Server to server has no CORS conversation. Judges will open the public URL, not your two-port laptop setup — allow that origin before you walk on stage.

What this unlocks

"Blocked by CORS policy" stops meaning "my app is illegal."

Allow the origins you mean. Or stop crossing the street from the tab.