CORS

1# CORS — v2 policies schema
2# v2 uses a policies array instead of flat origins.
3# max_age uses duration strings (e.g., 24h) not integers.
4cors:
5  allow_credentials: true
6  methods:
7    - GET
8    - POST
9    - OPTIONS
10  max_age: 24h
11  policies:
12    - origins:
13        - https://app.example.com
14        - https://studio.apollographql.com
15      allow_headers:
16        - Content-Type
17        - Authorization