Lovable
deployment
Supabase Storage Bucket CORS Error on Upload
File upload to Supabase Storage fails with CORS error. 'Access-Control-Allow-Origin' missing in response. Works with API key but not with RLS. Uploads blocked from production domain.
Supabase Storage requires CORS configuration and proper bucket settings for client-side uploads.
Error Messages You Might See
Access-Control-Allow-Origin header is missing
CORS policy does not allow access
No such bucket
Common Causes
- Bucket CORS not configured in Supabase
- Domain not added to allowed origins
- Not using public bucket when needed
- Trying to use private bucket with expired token
- RLS policy blocks upload operation
How to Fix It
Configure CORS in Supabase dashboard > Storage > Buckets > select bucket > CORS policy:
[
{
"origin": ["https://yourdomain.com"],
"methods": ["GET", "POST", "PUT", "DELETE"],
"allowedHeaders": ["*"]
}
]Use signed URLs for private uploads or public bucket for direct uploads.
Real developers can help you.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get Help