Hi OpenHands team! I am an engineer at PromptRoot (promptroot.ai) — a spec-driven development platform that helps development teams share reusable prompt templates, manage design specs, and dispatch tasks directly to AI coding assistants. We are big fans of OpenHands and are currently building a native integration that lets developers launch and dispatch prompts into OpenHands agent sessions directly from PromptRoot workflows. We think this will bring great mutual value and visibility to both of our communities! As we test our frontend web integration against OpenHands Cloud-hosted endpoints (like

<http://app.all-hands.dev|app.all-hands.dev>

), we are running into standard browser CORS restrictions (specifically, the

Access-Control-Allow-Origin

header is missing on cross-origin

fetch

responses). For context, our Google Jules integration works in a similar way: we send requests directly from our web frontend to Jules API endpoints to launch new sessions under selected repositories and branches. This works without CORS issues because Jules serves permissive

Access-Control-Allow-Origin

headers. My questions: 1. Is there an existing recommended workflow or CORS-enabled endpoint for web applications looking to dispatch tasks directly to OpenHands Cloud? 2. If not, is adding CORS support for third-party web clients something your team might consider down the road for OpenHands Cloud? Any advice or pointers would be greatly appreciated. Thanks for building such an awesome platform!

Hi Ryan, first, thanks for the nice use case! I believe that we shouldn’t be preventing CORS requests for endpoints that are validated with API keys. Do you have a minimal example of a script that causes issues?