> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyckr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Company V1 API – CORS and Framework Response Headers Removed

> The Company V1 API is server-to-server and no longer sends CORS or framework response headers. Browser calls must move to your back end.

## Overview

The Company V1 API (rest.kyckr.com) is a server-to-server API. It does not send CORS headers, so web browsers will block requests made directly from a web page. Call the API from your own back-end service and never expose your API key in browser code.

## What changed

Responses from rest.kyckr.com, including the Test environment at rest.kyckr.com/test, no longer include these headers:

* `Access-Control-Allow-Origin`
* `Access-Control-Allow-Headers`
* `Access-Control-Expose-Headers`
* `Request-Context`
* `X-Powered-By`
* `X-AspNet-Version`

Endpoints, request parameters, authentication and response bodies are unchanged.

## What you need to do

* **Server-side integrations:** nothing. Requests from your own servers work exactly as before.
* **Browser-based calls:** if any web page calls rest.kyckr.com directly from the browser, move that call to your back-end service. Your back end calls the API with your API key and returns the result to your page.

## Additional resources

* [Company V1 API Reference](https://developer.kyckr.com/company-v1/api-reference/overview.md)
* [FAQs](https://developer.kyckr.com/company-v1/guides/faq.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.