> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arc.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin API Settings

> How to configure CORS and authtoken settings for browser-based Admin API access in CData Arc.

export const siteNameShort = "Arc";

The **Admin API Options** portion of the **Security** page covers two types of {siteNameShort} configuration options.

<img src="https://mintcdn.com/cdata-arc/j59334epfVQRoK96/public/images/settings_admin_api.png?fit=max&auto=format&n=j59334epfVQRoK96&q=85&s=a1149bcf4077d6ec3b9f4712f4edbfb4" alt="Admin API settings" width="500" data-path="public/images/settings_admin_api.png" />

## Cross-Origin Resource Sharing (CORS)

CORS allows browser-based clients to connect to {siteNameShort}. Without CORS, browser-based scripts cannot connect to {siteNameShort} because of the same-origin policy enforced by the browser. This policy restricts client-side scripts and documents from loading resources outside their origin. The origin of a script consists of the protocol, host, and port. The following table describes the available CORS settings.

| Setting                                         | Description                                                                                                                |
| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Enable cross-origin resource sharing (CORS)** | Whether or not CORS is enabled. The rest of these options are only available when you check this box.                      |
| **Allow all domains without '\*'**              | If enabled, domain origins are not restricted to a specific list.                                                          |
| **Access-Control-Allow-Origin**                 | The comma-delimited list of domain origins to allow. Included as an HTTP response header.                                  |
| **Access-Control-Allow-Credentials**            | Whether or not user credentials such as cookies are allowed in cross-origin requests. Included as an HTTP response header. |
| **Access-Control-Allow-Methods**                | The comma-delimited list of methods to allow. Included as an HTTP response header.                                         |
| **Access-Control-Allow-Headers**                | The comma-delimited list of headers to allow. Included as an HTTP response header.                                         |
| **Access-Control-Max-Age**                      | The maximum duration (in seconds) that Access-Control response header values can be cached.                                |

## Authtoken in URL

Check this to allow the connector to pass the auth token in query string parameters for authentication. For example: `https://myarcinstance.com/api.rsc/connectors?@authtoken=myAuthTokenValue`.