---
sourceDocument: Zurich Customer Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/customer-service-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Customer Service Management

ft:clusterId :

    - csm

bundleId :

    - csm

workflow :

    - Customer and Industry


---

# Configure a CORS rule

# Configure a CORS rule for Engagement Messenger {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Configure a cross-origin resource sharing (CORS) rule to enable cross-domain requests between Engagement Messenger and your website where you want to deploy the messenger.

## Before you begin

Role required: admin  
You must complete the following tasks:

* [Configure Engagement Messenger](https://www.servicenow.com/docs/4v4hgCwNWlWIyqL3LFJ4FA "Create a Engagement Messenger module and configure its behavior, appearance, and styling. By creating a messenger module, you can customize the appearance and behavior according to your organizational branding and to suit your customer needs.").
* [Create an identity provider (IdP) for Engagement Messenger](https://www.servicenow.com/docs/P4GPSS2iLyhAXzOLVWfYyw "Create an IdP for your Engagement Messenger so that you can enable customer authentication. You can create an IdP for either the OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) authentication type.").
{#create-cors-for-rest-api-ec__ul_bf3_y2f_g4b}

## About this task

Use the Engagement Messenger API and your website URL to create a CORS rule.

## Procedure

1. Navigate to AllEngagement MessengerAdministrationCORS Rules.
2. Click New.
3. On the form, fill in the fields.  
   {#create-cors-for-rest-api-ec__table_ykv_fcs_f4b__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique name for the CORS rule. |
   | Application | Application scope for this record. |
   | REST API | Engagement Messenger REST API that this CORS rule applies to. Set this field to Engagement Center API \[sn_csm_ec/engagement_center_api\]. |
   | Domain | Domain that sends the request to this REST API. Set this field value to the URL of the website where you want to deploy the messenger. For example, https://www.example.com. |
   | Max age | Number of seconds to cache the client session. After an initial CORS request, further requests from the same client within this time do not require a preflight message. If you do not specify a value, the default value of 0 indicates that all requests require a preflight message. |
   | HTTP Methods | Allowed HTTP methods. Enable the GET and POST methods. |
   | HTTP Headers | Comma-separated list of HTTP headers to send in the response. You can leave this field empty. |
   [Table 1. CORS Rule form]

   {#create-cors-for-rest-api-ec__table_ykv_fcs_f4b}
4. Select Submit.

## What to do next

[Create HTTP response headers for Engagement Messenger](https://www.servicenow.com/docs/JOg6ENtUHOloSNA16W1NOw "Configure a name-value pair for HTTP response headers for the Engagement Messenger module. The ability to configure and pass response headers enables special handling of the page content by a client, which is most typically a browser.").

*[\>]: and then