How do I fix CORS errors from my server-side GTM container running on Cloud Run?

Why this happens

When client-side GTM sends data to your server-side GTM container on a different domain than the page itself, the browser enforces CORS and requires the server container to explicitly allow that origin. Server-side GTM containers handle this automatically for their standard clients when configured correctly - CORS errors usually mean either the requesting origin is not what the container expects (a staging domain hitting a container only configured for production, or a www vs. non-www mismatch), or a custom client you built yourself does not set CORS headers at all.

Fix it

1. Read the exact CORS error text in the browser console - it names the specific origin that was rejected and which header was missing. This tells you exactly which domain needs attention, not a guess.
2. Confirm the origin making the request (check for www vs. apex, http vs. https) exactly matches what your server container's client configuration expects - a mismatch usually points to a genuinely different origin (a staging environment, a preview deploy) rather than a header you need to hand-configure.
3. If you have built a Custom Client template in the server container, confirm it explicitly sets Access-Control-Allow-Origin matching the request's Origin header and handles the OPTIONS preflight request with a 200/204 response before the browser sends the real request.
4. Check whether the request uses credentials: 'include' - Access-Control-Allow-Origin of * is invalid when credentials are included; it must be the specific origin, with Access-Control-Allow-Credentials also set to true.
5. If you are behind a load balancer or CDN in front of Cloud Run, confirm it is not stripping or overriding CORS headers set by your container.

How to verify it worked

In the Network tab, find the failing request, check the OPTIONS preflight response (if one occurred) for Access-Control-Allow-Origin matching your page's exact origin and Access-Control-Allow-Methods including the method you are using, then confirm the actual non-preflight request also carries the matching header - a fixed preflight with a still-broken actual response is a common half-fix.