It seems like you're encountering Cross-Origin Resource Sharing (CORS) errors. This is likely due to the fact that your application and the Ory APIs are not on the same domain. The Ory security model uses HTTP cookies to manage sessions, tokens, and cookies, and for this to work, the Ory APIs must be exposed on the same domain as your application[^1^][^2^]. When developing locally, you should use either

localhost

or

127.0.0.1

, but not both[^1^][^2^]. Using both interchangeably in your code can cause problems with the origin of HTTP cookies sent by the application[^1^][^2^]. To get your application that runs locally and Ory APIs on the same domain, you can use Ory Tunnel, a development tool bundled with Ory CLI[^1^][^2^]. You can start the Ory Tunnel with the following command:

bash npx @ory/cli tunnel --dev <http://localhost:3000>

After running this command, Ory APIs will be mirrored on `http://localhost:4000`[^1^][^2^]. You should use this URL as the

baseUrl

for the

@ory/client

SDK[^1^][^2^]. The

--dev

flag disables security checks for easier integration and should not be used when deploying the Tunnel to a staging environment[^1^][^2^]. If you're still encountering CORS errors after following these steps, you can use the

--allowed-cors-origins

flag with the Ory Tunnel command to specify a list of allowed CORS origins[^8^]. However, Ory Network doesn't allow setting the CORS origins to be

*

,

null

or `localhost/127.0.0.1`[^6^]. For local development with

localhost/127.0.0.1

, it's recommended to use Ory Tunnel[^6^]. [^1^]: (source: https://www.ory.sh/docs/getting-started/integrate-auth/react#run-ory-apis-on-localhost) [^2^]: (source: https://www.ory.sh/docs/getting-started/local-development#local-development) [^6^]: (source: https://www.ory.sh/docs/guides/cors) [^8^]: (source: https://www.ory.sh/docs/cli/ory-tunnel#options)

I see that you're already using the Ory Tunnel for local development, which is the recommended way to avoid CORS issues[^1^][^2^][^6^]. However, the error message you're seeing suggests that there might be an issue with the way the tunnel is set up. Here are a few things you could check: 1. Ensure the Ory Tunnel is running on the correct port: The Ory Tunnel should be running on port 4000[^1^][^2^]. You can specify this port when starting the tunnel with the

--port

flag[^8^]. However, the

--port

flag is not mentioned in the official Ory documentation, so it's possible that it might not be supported. If specifying the port doesn't work, you could try running the tunnel without the

--port

flag, as the Ory APIs should be automatically mirrored on `http://localhost:4000`[^1^][^2^]. 2. Check the

baseUrl

in your application: The

baseUrl

for the

@ory/client

SDK in your application should be set to

<http://localhost:4000>

, which is where the Ory APIs are mirrored[^1^][^2^]. 3. Ensure the

--dev

flag is used for local development: The

--dev

flag disables security checks for easier integration and should be used when developing locally[^1^][^2^]. However, it should not be used when deploying the Tunnel to a staging environment[^1^][^2^]. 4. Check the allowed CORS origins: If you're still encountering CORS errors, you can use the

--allowed-cors-origins

flag with the Ory Tunnel command to specify a list of allowed CORS origins[^8^]. However, Ory Network doesn't allow setting the CORS origins to be

*

,

null

or `localhost/127.0.0.1`[^6^]. If you've checked all of these things and you're still encountering issues, it might be helpful to look at the debug output from the Ory Tunnel. You can enable debug output by using the

--debug

flag when starting the tunnel[^8^]. [^1^]: (source: https://www.ory.sh/docs/getting-started/integrate-auth/react#run-ory-apis-on-localhost) [^2^]: (source: https://www.ory.sh/docs/getting-started/local-development#local-development) [^6^]: (source: https://www.ory.sh/docs/guides/cors) [^8^]: (source: https://www.ory.sh/docs/cli/ory-tunnel#options)