Common errors · Supabase Edge Functions called from Lovable, Bolt, any browser app

Supabase Edge Function: blocked by CORS policy

Cause The function does not answer the OPTIONS preflight, or its error responses carry no CORS headers.
Fix Answer OPTIONS, add the CORS headers to every response including errors, then read the function logs for the real error.

Have it fixed for you, 290 EURSee the fix step by step

The function works with curl and fails from the browser. Browsers send an OPTIONS preflight first, and the function either crashes on it or answers without the CORS headers.

Where it breaks

Which case is yours?

1. The function does not handle the OPTIONS method, or returns headers only on success. An error response without CORS headers also shows up as a CORS error, hiding the real exception.

The fix, step by step

1. Answer the preflight and add the headers to every response, errors included.

   const cors = {
     "Access-Control-Allow-Origin": "https://app.example.com",
     "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
   };
   Deno.serve(async (req) => {
     if (req.method === "OPTIONS") return new Response("ok", { headers: cors });
     try {
       // ... your code
       return new Response(JSON.stringify(data), { headers: { ...cors, "Content-Type": "application/json" } });
     } catch (e) {
       return new Response(JSON.stringify({ error: String(e) }), { status: 500, headers: cors });
     }
   });

2. Call it with supabase.functions.invoke so the auth and apikey headers are set for you.
3. Then read the function logs in the dashboard: once CORS is fixed, the real error (missing secret, bad JSON) becomes visible.

How to check it is fixed

The Network tab shows OPTIONS 200 then POST 200 (or a readable 4xx/5xx with a JSON body), and no CORS line in the console.