Api.allorigins.win Raw URL Proxy: Usage, Errors, and Alternatives

The api.allorigins.win raw URL proxy helps browser-based applications retrieve content from another website when a direct request is blocked by Cross-Origin Resource Sharing (CORS) rules. Instead of requesting the resource directly, the browser sends the target URL to AllOrigins. The proxy fetches the resource on its server and returns it with cross-origin access.

The basic format is:

https://api.allorigins.win/raw?url=TARGET_URL

This public proxy is convenient for prototypes, testing, and retrieving non-sensitive public data. However, its security, availability, and performance limitations make it unsuitable for many production applications.

What Is api.allorigins.win?

AllOrigins is an open-source CORS proxy that retrieves content from external websites and makes it accessible to browser applications. It can return HTML, JSON, XML, RSS, or plain-text responses, depending on the destination resource.

Without a proxy, an application at https://myapp.com may be unable to read a response from https://example.org because they have different origins. If the target server does not allow that request, the browser may display:

Access to fetch has been blocked by CORS policy

AllOrigins changes the request flow. Your application contacts AllOrigins, which retrieves the target resource server-side and sends the response back in a CORS-accessible form.

AllOrigins Raw and Get Endpoints

AllOrigins provides different response formats. The two most useful endpoints are /raw and /get.

Use /raw when you want the returned content directly. Use /get when you want a JSON response in which the fetched page is available through data.contents.

How to Use api.allorigins.win/raw?url=

he target URL should be encoded before it is added to the proxy request. This is especially important when the destination URL contains its own query parameters.

const targetUrl = "https://example.org/";
const proxyUrl =
"https://api.allorigins.win/raw?url=" +
encodeURIComponent(targetUrl);
fetch(proxyUrl)
.then((response)=> {
if (!response.ok) {
throw new Error(`HTTP error: ${response.status}`);
}
return response.text();
})
.then((content) => console.log(content))
.catch((error) => console.error("Request failed:", error));

Because the destination in this example returns HTML, response.text() is used. If the target returns valid JSON, you can use response.json() instead.

Why encodeURIComponent() Is Important

Consider the following destination URL:

https://example.com/search?q=javascript&page=2

If it is added to the proxy without encoding, the browser or proxy may incorrectly interpret q and page as parameters belonging to the AllOrigins request. Encoding keeps the entire destination inside the url value.

const targetUrl =

"https://example.com/search?q=javascript&page=2";

const proxyUrl =

`https://api.allorigins.win/raw?url=${encodeURIComponent(targetUrl)}`;

For a URL with several parameters, create the destination first with URL and URLSearchParams, and then encode the completed URL.

Fetching and Parsing HTML

After retrieving HTML through the raw endpoint, you can parse it in the browser with DOMParser.

async function fetchPage(targetUrl) {
const proxyUrl =
`https://api.allorigins.win/raw?url=${encodeURIComponent(targetUrl)}`;
const response = await fetch(proxyUrl);
if (!response.ok) {
throw new Error(`Request failed: ${response.status}`);
}
const html = await response.text();
return new DOMParser().parseFromString(html, "text/html");
}
fetchPage("https://example.org/")
.then((documentData) => console.log(documentData.title))
.catch(console.error);

This method only parses the HTML returned by the target server. If the website loads its main content later with JavaScript, the initial response may contain an empty application container rather than the visible page content. AllOrigins retrieves the HTTP response but does not behave like a complete browser that renders the page and executes all scripts.

Using the /get Endpoint

The /get endpoint is useful when you prefer the result wrapped in JSON:

const targetUrl = "https://example.org/";
fetch(
`https://api.allorigins.win/get?url=${encodeURIComponent(targetUrl)}`
)
.then((response) => response.json())
.then((data) => console.log(data.contents))
.catch(console.error);

The main difference is how your application reads the response. With /raw, the target content is returned directly. With /get, it is normally accessed through the contents property.

Common AllOrigins Errors and Fixes

Public proxy requests can fail at the browser, proxy, network, or destination-server level. The following table covers the most common situations.

A public CORS proxy should not be used to bypass authentication, CAPTCHA, paywalls, access controls, or a website’s terms. It only changes how a browser accesses a cross-origin response.

Does AllOrigins Bypass CORS?

AllOrigins can help resolve browser CORS restrictions because the cross-origin request is made by an intermediary server. However, CORS is only one layer of web security. The proxy does not automatically overcome authorization, login requirements, firewalls, bot protection, private APIs, or server-side rate limits.

It is therefore more accurate to say that AllOrigins provides a CORS-enabled route to publicly accessible content. It is not a universal method for accessing restricted websites.

Is api.allorigins.win Safe?

The destination URL and returned content pass through a third-party service. Never use a public proxy for URLs containing API keys, access tokens, password-reset links, customer data, session identifiers, private documents, or internal application addresses.

You should also avoid relying on the proxy for confidential or business-critical workflows. The service may experience downtime, change its limits, return an unexpected response, or become unavailable without matching your application’s reliability requirements.

For public demonstrations and temporary experiments, these risks may be acceptable. For production systems, the safer approach is usually to control the server-side integration yourself.

Should You Use AllOrigins in Production?

AllOrigins is most appropriate for learning, testing, prototypes, and lightweight access to public data. Production applications often need stronger control over security, monitoring, caching, validation, retries, rate limits, credentials, and service availability.

A typical production architecture is:

Frontend → Your backend → Approved external API

Your frontend calls an endpoint on your own server. The backend then requests data from an approved destination and returns only the required information. This approach keeps credentials away from the browser and gives your team control over request handling.

Do not create an unrestricted backend endpoint that accepts any user-submitted URL. That design can introduce Server-Side Request Forgery (SSRF) risks. Use an allowlist of approved domains, validate all inputs, restrict protocols, and block access to internal network addresses.

Self-hosting AllOrigins

Because AllOrigins is open source, teams can inspect the project or operate their own instance. Self-hosting reduces dependence on the public service and provides more control over limits and monitoring. However, your team then becomes responsible for infrastructure, updates, abuse prevention, security, and scaling.

How Moon Technolabs Helps With API and Web Integration

Moon Technolabs helps businesses build secure API integrations, backend services, web applications, and cloud architectures for reliable cross-origin communication. Instead of depending on an unrestricted public proxy, our developers can create controlled backend services with domain allowlists, authentication, caching, validation, monitoring, retries, and rate limiting.

We also help teams troubleshoot CORS errors, integrate third-party REST APIs, secure frontend-to-backend communication, manage credentials, and deploy scalable Node.js or Python services. The result is an integration designed for business reliability rather than temporary browser access.

Conclusion

The api.allorigins.win raw URL proxy offers a simple way to retrieve publicly accessible content when browser CORS restrictions block a direct frontend request. The /raw endpoint returns the target content directly, while /get wraps the content in JSON.

For correct implementation, create the complete destination URL, encode it with encodeURIComponent(), verify the response status, and handle unexpected content types. AllOrigins is useful for prototypes and public-data experiments, but sensitive or production workloads are better handled through a secure backend integration or a carefully protected self-hosted service.