How to Split Frontend and API Origins in Local HTTPS Development

Keep the frontend and API on separate HTTPS origins in local development so you can test CORS, cookies, auth rules, and realistic host-based behavior.

One public hostname is not always enough. Many teams need the frontend and API on separate origins during development because production behaves that way. Bore supports that split without requiring a locally maintained reverse-proxy setup.

frontend api separate origin local devlocal https app and api subdomainslocal dev cors https origins

Install Bore

curl -sL https://bore.dk/install.sh | bash

Closer to real production topology

Useful for CORS and auth testing

Works with child hosts under one reserved namespace

How It Works

Simple local workflow, real HTTPS externally

Step 1

Expose the frontend namespace

Start the main app locally and create its HTTPS URL with Bore.

bore up 3000

Step 2

Reserve a child host for the API

Add a child host under the same namespace for the backend service.

bore host add <namespace> api

Step 3

Point the child host at the API port

Route the child host to the API's local port.

bore host set-port <namespace> api 3001

Step 4

Use the split origins in development

Keep the frontend on the root hostname and the API on the child host while testing real origin boundaries.

Where Bore Differs

Bore can keep HTTPS on reserved child hosts too

Most tunnel workflows stop at one public hostname. Bore can keep your main app on one HTTPS namespace and reserve a child host like `api.<namespace>.bore.dk` for a second local service.

bore host add <namespace> api
bore host set-port <namespace> api 3001

That matters when frontend and API origins need to stay separate in local development, or when webhook, auth, and admin traffic should not all share one hostname.

FAQ

Common questions

Why split frontend and API origins locally?

Because some CORS, cookie, and auth behaviors only show up when the app and API are actually on separate origins, just like production.

Can Bore keep both origins under one namespace?

Yes. Bore can keep the app on the root hostname and reserve a child host such as api.<namespace>.bore.dk for the API.

Is this better than hand-rolled local proxy config?

For many teams, yes. Bore keeps the local services simple and moves the public HTTPS routing to a reusable, persistent tunnel setup.

Related Guides

More HTTPS development guides

View all guides