# CORS - Non-interactive client **URL:** \ **Category:** Get Help\ **Tags:** cors, non-interactive\ **Created:** [February 3, 2018, 9:23pm UTC](https://community.auth0.com/t/cors-non-interactive-client/9392 "2018-02-03T21:23:17Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ramithindula](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@ramithindula](https://community.auth0.com/u/ramithindula)\ **Post date:** [February 3, 2018, 9:23pm UTC](https://community.auth0.com/t/cors-non-interactive-client/9392/1 "2018-02-03T21:23:17Z")
I’m getting a CORS issue when trying to get Auth0 Management API access token using non-interactive client. I tried adding [http://localhost:8100](http://localhost:8100) to Allowed Web Origins & Allowed Origins (CORS). It does not work. I can use a CORS enabler plugin in chrome and solve the issue but yet that gives me another error when I’m trying to meke other API calls. Any solution which I can do in my ionic project or in auth0 ? Thanks. ---
**Author:** ![richard.dowinton](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/richard.dowinton/32/16150_2.png) [@richard.dowinton](https://community.auth0.com/u/richard.dowinton)\ **Post date:** [March 2, 2018, 2:21pm UTC](https://community.auth0.com/t/cors-non-interactive-client/9392/2 "2018-03-02T14:21:08Z")
You should never use a non-interactive client on behalf of users, so there should be no need to add the origins. If you need to use the management API, you should use your own intermediary API rather than make requests from the user-facing application. Since you have a mobile application, you should use the [authorization code grant with PKCE](https://auth0.com/docs/api-auth/tutorials/authorization-code-grant-pkce). You can configure your intermediary API in Auth0 as specify it as an `audience` when performing the authorization flow. This will result in the access token containing an `aud` claim with the identifier of your API, which your API backend will check for when verifying the token. You can then make the necessary requests to the management API using the non-interactive client issued token from the backend based on the request from the user. I suggest you read through the [articles on API authorization](https://auth0.com/docs/api-auth) to gain a better understanding of how this works. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [July 25, 2019, 11:02am UTC](https://community.auth0.com/t/cors-non-interactive-client/9392/3 "2019-07-25T11:02:42Z")