# How to Configure CORS Settings to Allow Cross-Origin Requests in Private-GPT

> Learn how to configure CORS settings in Private-GPT to allow cross-origin requests. Easily enable and define access rules in your YAML file for seamless API integration.

- Repository: [Zylon/private-gpt](https://github.com/zylon-ai/private-gpt)
- Tags: how-to-guide
- Published: 2026-03-06

---

**Enable cross-origin requests in Private-GPT by setting `server.cors.enabled` to `true` in your YAML configuration file and defining the allowed origins, methods, and headers under the `server.cors` section.**

Private-GPT, the open-source project for document interaction using local LLMs, exposes a FastAPI-based HTTP API that requires explicit CORS configuration for browser-based clients. To configure CORS settings to allow cross-origin requests, you must modify the Pydantic-based settings in your environment-specific YAML file, which the application loads at startup to initialize the FastAPI middleware stack.

## Where CORS Is Implemented in the Source Code

The CORS middleware integration lives in two critical files within the `zylon-ai/private-gpt` repository. In [`private_gpt/settings/settings.py`](https://github.com/zylon-ai/private-gpt/blob/main/private_gpt/settings/settings.py), the `CorsSettings` Pydantic model (lines 16-55) defines the configuration schema with fields for `enabled`, `allow_origins`, `allow_origin_regex`, `allow_methods`, `allow_headers`, and `allow_credentials`.

The actual middleware injection occurs in [`private_gpt/launcher.py`](https://github.com/zylon-ai/private-gpt/blob/main/private_gpt/launcher.py) within the `create_app` function (lines 45-56). According to the source code, the application checks `settings.server.cors.enabled` and, if true, calls `app.add_middleware(CORSMiddleware, …)` with the values defined in the `CorsSettings` model.

## Step-by-Step CORS Configuration

### 1. Locate Your Environment Configuration File

Private-GPT uses YAML files for runtime configuration. Depending on your deployment target, edit [`settings.yaml`](https://github.com/zylon-ai/private-gpt/blob/main/settings.yaml), [`settings-local.yaml`](https://github.com/zylon-ai/private-gpt/blob/main/settings-local.yaml), or [`settings-docker.yaml`](https://github.com/zylon-ai/private-gpt/blob/main/settings-docker.yaml). The `server.cors` section in these files directly maps to the `CorsSettings` model.

### 2. Configure the CORS Parameters

Add or modify the `cors` block under `server`. The following table lists the configurable fields defined in [`private_gpt/settings/settings.py`](https://github.com/zylon-ai/private-gpt/blob/main/private_gpt/settings/settings.py):

- **enabled**: Boolean flag to activate CORS middleware (default: `false`)
- **allow_origins**: List of permitted origins (e.g., `["https://app.example.com"]`)
- **allow_origin_regex**: Regular expression pattern for dynamic origin matching (default: `null`)
- **allow_methods**: HTTP methods allowed (default: `["GET"]`)
- **allow_headers**: Request headers permitted (e.g., `["Authorization", "Content-Type"]`)
- **allow_credentials**: Boolean to permit cookies and authentication headers (default: `false`)

### 3. Apply Changes and Restart

After saving your YAML file, restart the Private-GPT server. The FastAPI application will instantiate `CORSMiddleware` with your specified parameters, injecting the appropriate `Access-Control-Allow-Origin` and related headers into HTTP responses.

## CORS Configuration Examples

### Local Development Environment

For frontend development on `localhost:3000`, configure [`settings-local.yaml`](https://github.com/zylon-ai/private-gpt/blob/main/settings-local.yaml) as follows:

```yaml
server:
  env_name: local
  port: 8001
  cors:
    enabled: true
    allow_credentials: false
    allow_origins:
      - "http://localhost:3000"
      - "http://127.0.0.1:3000"
    allow_methods:
      - "GET"
      - "POST"
      - "OPTIONS"
    allow_headers:
      - "*"

```

### Production Deployment

For a secured production frontend, use [`settings-docker.yaml`](https://github.com/zylon-ai/private-gpt/blob/main/settings-docker.yaml) or [`settings.yaml`](https://github.com/zylon-ai/private-gpt/blob/main/settings.yaml):

```yaml
server:
  env_name: prod
  port: 8001
  cors:
    enabled: true
    allow_credentials: true
    allow_origins:
      - "https://app.mycompany.com"
    allow_methods:
      - "GET"
      - "POST"
      - "PUT"
      - "DELETE"
      - "OPTIONS"
    allow_headers:
      - "Authorization"
      - "Content-Type"

```

## Summary

- Private-GPT implements CORS through FastAPI's `CORSMiddleware`, conditionally added in [`private_gpt/launcher.py`](https://github.com/zylon-ai/private-gpt/blob/main/private_gpt/launcher.py) (lines 45-56).
- The `CorsSettings` Pydantic model in [`private_gpt/settings/settings.py`](https://github.com/zylon-ai/private-gpt/blob/main/private_gpt/settings/settings.py) (lines 16-55) defines all configurable fields including `allow_origins` and `allow_origin_regex`.
- Set `server.cors.enabled` to `true` in your YAML configuration to activate cross-origin support.
- Define explicit origins with `allow_origins` or use regex patterns with `allow_origin_regex` for dynamic subdomain matching.
- Always restart the server after modifying CORS settings to reload the middleware with new parameters.

## Frequently Asked Questions

### How do I enable CORS for all origins in Private-GPT?

Set `allow_origins` to `["*"]` in your configuration file. This setting permits any origin to access the API, but should only be used in local development environments due to security implications.

### Why am I still seeing CORS errors after enabling the settings?

Verify that you restarted the server after saving the YAML file. Also ensure the origin URL in your browser request exactly matches the entries in `allow_origins`, including the protocol (`https` vs `http`) and any port numbers.

### Can I use regex patterns instead of listing specific origins?

Yes. Use the `allow_origin_regex` field to define a pattern such as `"^https://.*\\.example\\.com$"` to match multiple subdomains dynamically. This parameter is processed by the `CORSMiddleware` initialization in [`private_gpt/launcher.py`](https://github.com/zylon-ai/private-gpt/blob/main/private_gpt/launcher.py).

### Do I need to enable `allow_credentials` for API key authentication?

If your cross-origin requests include the `Authorization` header or cookies, set `allow_credentials` to `true` and explicitly list your origins (wildcard origins are not permitted when credentials are enabled). Ensure `Authorization` is included in the `allow_headers` list.