Does the ClearRun SDK run in the browser?

No. Call ClearRun from your server, or from a proxy you run. The API key is a secret and must never be in browser code, so the API does not accept calls from web pages on other sites. That is on purpose.

Last updated

Why there is no CORS

Anyone can read the code a browser runs, including any key in it. A key in a web page can spend your credits. So the API sends no CORS headers, and browsers block calls to it from other sites. This is by design.

What to do instead

  1. Call ClearRun from your server, a serverless function, or a small proxy you run.
  2. Keep the key in a server environment variable.
  3. Send only the verdict your page needs back to the browser.

Lookups too

GET /api/verify/{verdictId} needs no key, but browsers still block it from another site's page. Look it up on your server, or link to it.