# Http header not setting for api call **URL:** \ **Category:** ionic-v3\ **Created:** [April 17, 2017, 1:03pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796 "2017-04-17T13:03:18Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 1:03pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/1 "2017-04-17T13:03:18Z")
well guys I spend almost a whole day to get data from api call… when i pass the url and header data(API key and value) in postman… it is working fine but when i pass the data in ionic http request… it is returning me the same error all the time… **401 - Unauthorized: Access is denied due to invalid credentials**. I am passing my authorization data in header but somehow the error is still there… this is my code let headers = new Headers(); headers.append(‘JsonOdds-API-Key’, ‘ae0294c7-3f2a-485c-a541-417196ea6416’); let options = new RequestOptions({ Headers: headers }); return this.http.get(‘[https://jsonodds.com/api/odds](https://jsonodds.com/api/odds)’, options).map(res =\> res.json()); tell me what am i doing wrong in my ionic code… cox I am getting data from postman by passing the link and header token data… ---
**Author:** ![ashley\_shookhye](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@ashley\_shookhye](https://forum.ionicframework.com/u/ashley_shookhye)\ **Post date:** [April 17, 2017, 2:52pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/2 "2017-04-17T14:52:40Z")
Please correct to below and try(headers with small h) `let options = new RequestOptions({ headers: headers });` Ashley ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:03pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/3 "2017-04-17T20:03:03Z")
Thanks ashley for the response… there is still a problem after updating the line… **XMLHttpRequest cannot load [https://jsonodds.com/api/odds](https://jsonodds.com/api/odds). Response for preflight has invalid HTTP status code 401** can you please tell me what is the exact issue ☹ ---
**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\ **Post date:** [April 17, 2017, 8:06pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/4 "2017-04-17T20:06:41Z")
> [@owaisbakhtiar](#): > > Response for preflight has invalid HTTP status code 401 Does this happen when running on an actual device? ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:10pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/5 "2017-04-17T20:10:31Z")
right now I am trying on browser rapropos… and also I have to give the end project as a web app not mobile app… that is why trying on browser… other http get request are working fine however in this http request I have to set header for passing key and somehow it is giving this error ---
**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\ **Post date:** [April 17, 2017, 8:14pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/6 "2017-04-17T20:14:13Z")
> [@owaisbakhtiar](#): > > I have to give the end project as a web app not mobile app Then I’ve got some really bad news for you. If the backend server doesn’t support sending proper `Access-Control-Allow-Origin` headers (as described in [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)), you might be SOL in a browser environment. ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:18pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/7 "2017-04-17T20:18:23Z")
What should i do for this @rapropos ☹ here is the exact error message i receive… ![image](https://global.discourse-cdn.com/ionicframework/original/3X/1/f/1f9b0012cc5fad348c63f4ad0bcf7cb1966dcb4f.png) ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:21pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/8 "2017-04-17T20:21:50Z")
When I check this on postman or through curl… the Api is returning proper data to me… ---
**Author:** ![Sujan12](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/sujan12/32/108395_2.png) [@Sujan12](https://forum.ionicframework.com/u/Sujan12)\ **Post date:** [April 17, 2017, 8:32pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/9 "2017-04-17T20:32:54Z")
Are you doing an OPTIONS request (not GET or POST) in Postman or curl to do what is called a “preflight request”? ---
**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\ **Post date:** [April 17, 2017, 8:37pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/10 "2017-04-17T20:37:01Z")
CORS has a rather complex definition of what it considers a “simple request”, and anything that doesn’t meet it triggers an automatic preflight at a level below ordinary client code control. That nonstandard “JsonOdds-API-Key” header, which I assume is required to access the backend, DQs any request including it from being considered “simple”. ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:37pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/11 "2017-04-17T20:37:42Z")
Well I tried get in postman @Sujan and simply added the required key in header… and it works fine their… but adding header here is not helping me ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:41pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/12 "2017-04-17T20:41:51Z")
why the same jsonOdds-API-Key works fine on postman and curl @rapropos ---
**Author:** ![Sujan12](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/sujan12/32/108395_2.png) [@Sujan12](https://forum.ionicframework.com/u/Sujan12)\ **Post date:** [April 17, 2017, 8:42pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/13 "2017-04-17T20:42:28Z")
Of course GET works. But because of security stuff, the client first tries a preflight, OPTIONS request to the URL. Only when this is answered correctly (status code 401 is not correct for example) the real request will go out. ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:45pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/14 "2017-04-17T20:45:30Z")
Is there a way to move out of this issue guys? ☹ I almost wasted complete day on this ---
**Author:** ![Sujan12](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/sujan12/32/108395_2.png) [@Sujan12](https://forum.ionicframework.com/u/Sujan12)\ **Post date:** [April 17, 2017, 8:46pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/15 "2017-04-17T20:46:45Z")
Quick and dirty fix: Write a proxy that you host on your server that receives a request and just forwards it to that server. You can add whatever header you want, then. ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:49pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/16 "2017-04-17T20:49:40Z")
hmmmmm ok i will try this … thanks for the time guys 🙂 ---
**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\ **Post date:** [April 17, 2017, 8:51pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/17 "2017-04-17T20:51:47Z")
> [@owaisbakhtiar](#): > > why the same jsonOdds-API-Key works fine on postman and curl @rapropos Because you’re not actually doing what the browser is doing. Try this: ```auto $ curl -H "Origin: http://www.somewhere.net" -H "Access-Control-Request-Method: GET" -H "Access-Control-Request-Headers: X-Requested-With" -X OPTIONS https://jsonodds.com/api/odds ``` You should get a 401. Now try the same thing with a backend that properly handles CORS: ```auto $ curl --verbose -H "Origin: http://www.somewhere.net" -H "Access-Control-Request-Method: GET" -H "Access-Control-Request-Headers: X-Requested-With" -X OPTIONS http://ip.jsontest.com/ ``` You should get a 200 with an `Access-Control-Allow-Origin: *` header. This is how things are supposed to work. > [@owaisbakhtiar](#): > > Is there a way to move out of this issue guys? Change to a backend that properly implements CORS (like @Sujan12’s proxy suggestion) or give up on having this work in a browser context. ---
**Author:** ![Sujan12](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/sujan12/32/108395_2.png) [@Sujan12](https://forum.ionicframework.com/u/Sujan12)\ **Post date:** [April 17, 2017, 8:56pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/18 "2017-04-17T20:56:05Z")
Googled a bit, there are ready made proxies and even hosted versions: [http://anyorigin.com/](http://anyorigin.com/) > **[Rob--W/cors-anywhere](https://github.com/Rob--W/cors-anywhere)** > > cors-anywhere - CORS Anywhere is a NodeJS reverse proxy which adds CORS headers to the proxied request. > **[gr2m/CORS-Proxy](https://github.com/gr2m/CORS-Proxy)** > > CORS-Proxy - über-simple node.js-Proxy to enable CORS request for any website > **[ripper234/Whatever-Origin](https://github.com/ripper234/Whatever-Origin)** > > Whatever-Origin - An open source alternative to AnyOrigin.com (this project is looking for a maintainer) ---
**Author:** ![owaisbakhtiar](https://avatars.discourse-cdn.com/v4/letter/o/48db29/32.png) [@owaisbakhtiar](https://forum.ionicframework.com/u/owaisbakhtiar)\ **Post date:** [April 17, 2017, 8:58pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/19 "2017-04-17T20:58:51Z")
Thanks @Sujan12… I will definitely try it 🙂 ---
**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\ **Post date:** [April 17, 2017, 9:01pm UTC](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796/20 "2017-04-17T21:01:59Z")
I feel like it’s worth mentioning that CORS exists for really good reasons beyond “making your life miserable”, and subverting it should only be done after a lot of careful research, thought, and planning and in as constrained a way as possible. Blindly setting up unsecured proxy servers is not a great idea, and may even expose you to ToS violations of hosting services and/or upstream backends, including legal liability. Before going down this route, I would first try contacting technical support for the backend service and explaining to them that you are having CORS trouble with their service. They should be able to fix this. [Next page](https://forum.ionicframework.com/t/http-header-not-setting-for-api-call/86796.md?page=2)