HubSpot Forms API: CORS policy & CORS preflight error for custom domain

Develop, Build & Integrate Developer Platform & Tooling
1

Hello HubSpot Community,

We are currently integrating the HubSpot Forms API (v3) on our clinic web portal to submit patient lead inquiries directly into our HubSpot CRM pipeline.

Technical Issue: When submitting the contact form from our primary domain (avangartclinic.com), the browser blocks the POST request with a CORS policy preflight error.

Environment Details:

  • API Endpoint: [https://api.hsforms.com/submissions/v3/integration/submit/](https://api.hsforms.com/submissions/v3/integration/submit/){portalId}/{formGuid}

  • Origin Domain: (avangartclinic.com)

  • Error in Console: Access to fetch at '[https://api.hsforms.com/](https://api.hsforms.com/)...' from origin '(avangartclinic.com)' has been blocked by CORS policy.

Steps Taken:

  1. Verified that portalId and formGuid are correct.

  2. Checked that request headers include Content-Type: application/json.

  3. Cleared browser cache and tested in Incognito mode, but the origin restriction persists.

Are there specific domain allowlist steps required in the HubSpot Portal settings to allow API form submissions from (avangartclinic.com)?

Any advice or troubleshooting steps would be greatly appreciated.

Thanks!

3

Hey @avangartclinic, thanks for reaching out to the HubSpot Community and sharing the steps you’ve already taken!

I can confirm that this endpoint " Submit data to a form (unauthenticated) - HubSpot docs " supports cross-origin (CORS) AJAX requests, so CORS blocking is not an expected behavior.

Can you please confirm that you’re using the unauthenticated endpoint (/submissions/v3/integration/submit/{portalId}/{formGuid}) and not the secure one (/submissions/v3/integration/secure/submit/…)? Because the secure endpoint requires authentication and won’t work as a plain cross-origin AJAX call from a browser.

Also, I’d love to hear from our Top Experts: Hi @evaldas, @Anton and @SteveHTM do you have suggestions to help @avangartclinic, please?

Wishing you a wonderful day, and thanks so much for your help! :orange_heart:

Bérangère

4

Hi @avangartclinic,

If your HubSpot account is provisioned in a non-US data center (EU hosting, for example), submissions have to go to that region’s host (api-eu1.hsforms.com, not api.hsforms.com). Posting to the wrong regional host may lead to a CORS failure.

Worth checking your account’s data hosting location in HubSpot settings against the endpoint host you’re calling.