# Credentials and CORS

Client mode should only expose browser-safe values such as OAuth client IDs or
public Google Drive API keys. Storage credentials and OAuth client secrets
belong in server mode.

## CORS

For browser direct uploads, configure your bucket to allow the exact app
origins that will upload files.

```tsx
<UpupUploader
    cors={{
        dangerouslyAutoConfigure: true,
        allowedOrigins: ['http://localhost:3000'],
        allowedMethods: ['PUT', 'POST', 'OPTIONS'],
        allowedHeaders: ['Content-Type', 'Authorization'],
    }}
/>
```

`dangerouslyAutoConfigure` can mutate storage CORS policy. Keep it for local
setup and controlled admin tooling, not broad production defaults.

## Server Credentials

Use `@useupup/server` for storage access keys, OAuth client secrets, provider
token refresh, audit logging, and server-side transfers.