Playground and Experiment Failures Due to Missing CORS Header After Upgrade

Last updated: January 28, 2026

This issue is applicable to customers matching these conditions

Plans: Enterprise

Deployments: Hybrid

Use case: Running playgrounds or experiments

Issue

After upgrading Braintrust (to v1.1.29 or later), users may encounter failures when using the Playground or creating/running experiments.

Symptoms include:

  • Errors in the Braintrust UI such as:

    • “Failed to run playground”

    • “TypeError: Failed to fetch”

  • Browser console errors similar to:

    Blocked by CORS policy:
    Request header field x-bt-project-id is not allowed by
    Access-Control-Allow-Headers in preflight response

These errors can result in the Playground or experiment workflows being completely unusable.

Cause

Starting in v1.1.29, Braintrust introduced support for project-level AI secrets.
To support this feature, the Braintrust frontend now sends a new HTTP header:

x-bt-project-id

If a customer’s deployment has a restricted or custom CORS configuration that explicitly lists allowed headers, and this new header is not included, the browser will block requests to the Braintrust data plane.

This most commonly affects:

  • Hybrid self-hosted deployments

  • Customers not using the default Braintrust Terraform templates

  • Deployments with locked-down or manually maintained CORS policies

Resolution

Update your CORS configuration to allow the new header.

Steps

  1. Locate the CORS configuration for your Braintrust data plane (e.g., API Gateway, ALB, Lambda proxy, or equivalent).

  2. Add the following header to the allowed headers list:

x-bt-project-id

  1. Apply or redeploy the updated configuration.

  2. Reload the Braintrust UI and retry the Playground or experiment workflow.

Once this header is allowed, the errors should immediately resolve.

Notes