--server-enable-cors

CLI

--server-enable-cors

REST

CLI only

Lets a web page on another origin call the server. Without a value any origin is allowed; with a comma-separated list of origins, only those.

• Preflights are answered before authentication, so a page sends its token on the request itself.
• GET, POST and DELETE are allowed, with Content-Type, Authorization and the MCP session headers.
• Link is exposed, so a page reads the URLs of a render’s additional assets and fetches them from /assets. Content-Disposition, Content-Digest, ETag, Age, Server-Timing and x-zshot-llm-usage are exposed too.

Example

zshot --server \
  --server-token-auth s3cr3t \
  --server-enable-cors=https://app.example.com,http://localhost:5173