Cross-origin API access (CORS)

Prerequisites

• A Codebahn account
• A browser-based tool or frontend that needs API access

Codebahn’s REST API accepts cross-origin requests. Browser-based tools running on your own domain can call the API directly, no proxy needed.

How it works

Every API response includes CORS headers that allow requests from any origin. Authentication is still required: you need a valid access token or OAuth session. CORS only tells the browser it is allowed to read the response.

Credentials (cookies) are not sent on cross-origin requests. The only way to authenticate is by explicitly passing a token in the Authorization header.

Authentication options

Personal access token

Create one under Settings > Applications > Access Tokens. Pass it as a header:

Authorization: token YOUR_TOKEN_HERE

Good for personal tools, scripts, and quick integrations.

OAuth (PKCE)

For tools that support OAuth, create an OAuth application under Settings > Applications:

1. Set the Redirect URI to your tool’s callback URL.
2. Uncheck Confidential to make it a public client (required for browser apps).
3. Copy the Client ID into your tool’s config.

The tool handles the OAuth flow from there. No client secret is needed for public clients.

Example: Sveltia CMS

Sveltia CMS is a headless CMS that uses Codebahn as a Git backend. Your site’s content lives in a Codebahn repository, and the CMS admin panel reads and writes files through the API.

Setup

1. Create an OAuth application in your Codebahn account (see above). Set the redirect URI to your CMS admin URL.
2. Add a config.yml to your site’s repository:

backend:
  name: gitea
  repo: your-org/your-repo       # owner/repo on Codebahn
  base_url: https://codebahn.net
  api_root: https://codebahn.net/api/v1
  app_id: YOUR_CLIENT_ID          # from the OAuth app you created

3. Open your CMS admin page. Codebahn’s OAuth flow handles login.

You can also skip OAuth and use a personal access token instead. On the CMS login screen, choose “Sign In with Token” and paste your token.

How it works

Sveltia CMS runs entirely in the browser. When you edit content, it calls Codebahn’s API to read files, create commits, and push changes to your repository. The published site is static and never talks to Codebahn; only the admin panel does.

What’s next

Webhooks

MCP server

CLI