> What does this mean, and what are the 'routes which you will be using supertokens', is this all routes with supertokens middleware or just /login? and how do you add this? All routes that requires supertokens middleware (session verification to get userId) must have this. It means that in your API response, you have to set these headers so that the browser does not block the request. You do not need this for mobile apps, so I will not elaborate much on it. > isnt the hostname or port number always different between API and website? No actually. You can have your website on example.com and your APIs on example.com/api/* In this case, you do not get any CORS error. Wordpress for example, does something like this. > also is this applicable for mobile apps? No.