# Access-Control-Allow-Credentials header

> Indicates whether the response can be exposed when the CORS request includes credentials.

Source: https://apiguide.dev/headers/access-control-allow-credentials
Direction: response
Registered: yes
Defined in: WHATWG Fetch Standard <https://fetch.spec.whatwg.org/>
Updated: 2026-07-10

## What is the Access-Control-Allow-Credentials header?

The `Access-Control-Allow-Credentials` response header tells the browser whether JavaScript may read the response when the cross-origin request was made with credentials such as cookies, TLS client certificates, or `Authorization` headers. Its only valid value is `true`.

## API Usage & Best Practices

* **Requires an explicit origin**: When set to `true`, `Access-Control-Allow-Origin` must name a specific origin; the wildcard `*` is rejected by the browser for credentialed requests.
* **Client must opt in too**: The header only has effect when the client sends the request with `credentials: 'include'` (Fetch) or `withCredentials = true` (XHR).
* **Applies to headers too**: With credentials, wildcards in `Access-Control-Allow-Headers` and `Access-Control-Allow-Methods` are also ignored.

## Examples

```http
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
```