Astro CORS 1.0.3 — Magento Admin setup

00:00:00 — Set up Astro CORS
Welcome to the Agentic Ecom Astro CORS guide. We'll use Magento Admin to review the setup and explain the handoff to your headless storefront. This walkthrough covers stable version 1 point 0 point 3 and assumes the extension is installed.

00:00:16 — Open settings and choose scope
Open Stores, Configuration, then Astro CORS. Check the Scope selector first. Graph Q L and REST have separate policies, so allow the origins used by each part of your storefront. An origin is the scheme, host and optional port, without a page path.

00:00:35 — Allow your GraphQL origins
Expand Graph Q L CORS Policy. Enter the exact storefront origins in Allowed Origins, such as your production H T T P S domain and any approved staging domain. Review Allowed Methods and Allowed Headers for the requests your frontend actually sends. Keep access limited to the sites you control.

00:00:57 — Check credentials and preflight caching
Allow Credentials controls credentialed browser requests. When credentials are needed, use explicit origins rather than a wildcard. Max Age is the browser's preflight cache duration in seconds. Exposed Headers lists response headers your JavaScript needs to read; it does not grant API permissions.

00:01:18 — Review the REST policy
Open REST API CORS Policy and repeat the origin, method and header checks for REST consumers. A working Graph Q L policy does not automatically configure REST. CORS affects browser access; Magento authentication and authorisation still apply to protected operations.

00:01:37 — Decide on the optional redirect
Headless Storefront Redirect is optional. If you enable it, enter your storefront's full base URL and choose the redirect type deliberately. Check Allowed Front Names for payment returns and other callbacks that must remain on Magento. Coordinate this setting with Headless Lock so their behaviour agrees.

00:01:57 — Save and test from the browser
On your staging store, save the configuration and refresh the relevant Magento cache. Open the storefront and inspect its actual API requests in browser developer tools. Verify the preflight and final response for an allowed origin, then confirm an unapproved origin is not granted access. This demonstration has not submitted a configuration change.

00:02:20 — Your setup checklist
Your next steps are to confirm exact allowed origins, review credentials and callback paths, save and test browser api requests. Use a staging store for the end-to-end check. The complete installation and integration reference is at user guides dot Agentic Ecom dot net.