WEBVTT

00:00:00.250 --> 00:00:05.881
Welcome to the AgenticEcom Astro CORS guide. We'll use Magento Admin to review the setup

00:00:06.055 --> 00:00:11.500
and explain the handoff to your headless storefront. This walkthrough covers stable version 1

00:00:11.628 --> 00:00:15.575
point 0 point 3 and assumes the extension is installed.

00:00:16.625 --> 00:00:22.256
Open Stores, Configuration, then Astro CORS. Check the Scope selector

00:00:22.325 --> 00:00:27.898
first. GraphQL and REST have separate policies, so allow the origins used by

00:00:27.980 --> 00:00:33.657
each part of your storefront. An origin is the scheme, host and optional port, without

00:00:33.692 --> 00:00:34.829
a page path.

00:00:35.879 --> 00:00:41.080
Expand GraphQL CORS Policy. Enter the exact storefront

00:00:41.150 --> 00:00:46.641
origins in Allowed Origins, such as your production HTTPS domain and any

00:00:46.699 --> 00:00:51.912
approved staging domain. Review Allowed Methods and Allowed Headers for the requests your

00:00:51.970 --> 00:00:56.963
frontend actually sends. Keep access limited to the sites you control.

00:00:58.013 --> 00:01:03.493
Allow Credentials controls credentialed browser requests. When credentials are needed, use

00:01:03.528 --> 00:01:09.031
explicit origins rather than a wildcard. Max Age is the browser's preflight cache

00:01:09.066 --> 00:01:14.313
duration in seconds. Exposed Headers lists response headers your JavaScript needs to

00:01:14.406 --> 00:01:17.564
read; it does not grant API permissions.

00:01:18.614 --> 00:01:24.071
Open REST API CORS Policy and repeat the origin, method and header checks for

00:01:24.152 --> 00:01:29.818
REST consumers. A working GraphQL policy does not automatically configure REST.

00:01:30.212 --> 00:01:35.901
CORS affects browser access; Magento authentication and authorisation still apply to protected

00:01:35.948 --> 00:01:37.097
operations.

00:01:38.147 --> 00:01:43.685
Headless Storefront Redirect is optional. If you enable it, enter your storefront's full base

00:01:43.755 --> 00:01:49.107
URL and choose the redirect type deliberately. Check Allowed Front Names for payment

00:01:49.153 --> 00:01:54.714
returns and other callbacks that must remain on Magento. Coordinate this setting with Headless Lock

00:01:54.784 --> 00:01:56.491
so their behaviour agrees.

00:01:57.541 --> 00:02:02.742
On your staging store, save the configuration and refresh the relevant Magento cache.

00:02:03.079 --> 00:02:08.153
Open the storefront and inspect its actual API requests in browser developer tools.

00:02:08.768 --> 00:02:14.213
Verify the preflight and final response for an allowed origin, then confirm an unapproved

00:02:14.271 --> 00:02:19.786
origin is not granted access. This demonstration has not submitted a configuration change.

00:02:20.836 --> 00:02:26.200
Your next steps are to confirm exact allowed origins, review credentials and callback

00:02:26.269 --> 00:02:31.343
paths, save and test browser api requests. Use a staging store for the

00:02:31.424 --> 00:02:36.614
end-to-end check. The complete installation and integration reference is at user guides dot

00:02:36.684 --> 00:02:38.715
AgenticEcom dot net.