Why can't I call Backfire from the browser like a CORS proxy?

Because the key would be visible to anyone who opens devtools. Backfire is a server-side relay: your backend holds the key and proxies the result.

Is there a free tier?

Yes — 5,000 trips on signup, no card and no subscription. They do not expire.

Backfire vs a public CORS proxy

Backfire compared with a public CORS proxy

A public CORS proxy such as corsproxy.io or AllOrigins solves a browser problem: your page cannot call another origin, so you relay the request through a host that sends permissive CORS headers back. It costs nothing and requires no account — which is exactly why it is unbounded, unattributed and frequently rate-limited.

Which one you actually need

For a weekend prototype or a demo, a free CORS proxy is fine and this page will not pretend otherwise. For anything with a user, a secret or a bill attached, you want a key, a guard and a record — which is the whole product here.

Credentials

A public CORS proxy: None — anyone can use it, including your abuser
Backfire: Bearer key, hashed at rest, revocable

Who pays for abuse

A public CORS proxy: The proxy operator, until it rate-limits everyone
Backfire: Your prepaid balance, and only for your calls

Target validation

A public CORS proxy: Usually none, or a hostname blocklist
Backfire: Addresses checked after DNS, redirects never followed

Attribution

A public CORS proxy: None
Backfire: Every call tied to a key and written to your log

Availability

A public CORS proxy: Best effort, often throttled or retired
Backfire: Published limits, 600/min per key

Secrets in transit

A public CORS proxy: Sent through a stranger's host
Backfire: Sent to a service you have an account with

Cost model

A public CORS proxy: Free, until it disappears
Backfire: Prepaid trips, no subscription

Dimension	A public CORS proxy	Backfire
Credentials	None — anyone can use it, including your abuser	Bearer key, hashed at rest, revocable
Who pays for abuse	The proxy operator, until it rate-limits everyone	Your prepaid balance, and only for your calls
Target validation	Usually none, or a hostname blocklist	Addresses checked after DNS, redirects never followed
Attribution	None	Every call tied to a key and written to your log
Availability	Best effort, often throttled or retired	Published limits, 600/min per key
Secrets in transit	Sent through a stranger's host	Sent to a service you have an account with
Cost model	Free, until it disappears	Prepaid trips, no subscription

Side by side

cors-proxies

// free proxy: the target and your headers pass through a stranger's host
const res = await fetch('https://corsproxy.io/?' + encodeURIComponent(userUrl));

// relay: the key stays server-side, the target is validated first
const res = await fetch('https://backfireapi.base44.app/functions/forward', {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.BACKFIRE_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ url: userUrl, method: 'GET', timeout_ms: 8000 }),
});

Where the other one wins

A free proxy sees every header you send through it, including any Authorization header meant for the target. That alone disqualifies it for anything real.
Open proxies attract abuse within hours. If a free endpoint is up, it is usually because it is fighting bots — and your product is indistinguishable from them.
Backfire is not free, and that is a feature: a key, a balance and an activity log make abuse visible to the person who caused it.
A CORS proxy also works from the browser directly. Backfire does not: keys belong on a server, and a browser-embedded key is a public key.

What Backfire will not do

Not callable from the browser: a bearer key in client code is a published key. Keep it server-side.
No CORS relaxation for your own API — Backfire does not add headers to your responses.
Not free and not anonymous, by design.
One trip per completed roundtrip, so a prototype that hammers it will cost something.

Other comparisons

ScrapingBee ScraperAPI Bright Data Hookdeck