Title: CORS And URLs Description: This page is for operators configuring public URLs and allowed browser origins. Canonical: https://docs.openpo.st/configuration/cors-and-urls Source: [https://docs.openpo.st/configuration/cors-and-urls](https://docs.openpo.st/configuration/cors-and-urls) # CORS And URLs This page is for operators configuring public URLs and allowed browser origins. These settings solve many deployment problems when they are set correctly. ## `OPENPOST_APP_URL` The public URL users visit in the browser. This is also part of the default CORS allowlist. ## `OPENPOST_EXTRA_CORS_ORIGINS` Extra origins to allow, as a comma-separated list. Use this if you have alternate domains, admin origins, or a separate dev frontend. Self-hosted mode also allows local browser development origins by default. Cloud mode is stricter: it allows `OPENPOST_APP_URL` and explicit extra origins only, and rejects wildcard `*` origins at startup. The native Expo app calls the HTTP API directly and does not need a browser CORS origin. ## `OPENPOST_MEDIA_URL` The public base URL for uploaded media. Threads, Facebook, Instagram, and some TikTok posts need it. The default `/media` path is resolved against `OPENPOST_PUBLIC_URL`, then `OPENPOST_APP_URL`. Override it with an absolute URL when media is served from a separate public origin. ## Provider callback URLs These are configured in the provider developer portals and should point back to your public OpenPost domain. They are separate from browser CORS settings. ## Common mistakes - `OPENPOST_APP_URL` still points at localhost in production - Hosted/cloud mode relies on implicit localhost CORS origins instead of explicit `OPENPOST_EXTRA_CORS_ORIGINS` - `OPENPOST_EXTRA_CORS_ORIGINS` contains `*` while credentials are enabled - `OPENPOST_MEDIA_URL` points at an internal hostname that a social network cannot open - Provider callback URLs still use the local development domain - Reverse proxy serves a different hostname than the one configured in OAuth apps