Use this little website to test if a URL is setup correctly to work with CORS.
Shareable link: https://cors-test.codehappy.dev/?method=get&origin=https%3A%2F%2Fcors-test.codehappy.dev%2F&url=http%3A%2F%2Fbtcgandalf.com%2F.well-known%2Fnostr.json
It does not have the access-control-allow-origin header set to *. Without this header, requests from other domains cannot be made to it via a users browser.
If you have access to the server for the URL, you'll need to modify it to add the access-control-allow-origin header. If you do not have access, you'll need to upload the file somewhere else.
These are the response headers received when making the request.
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: a2fa33b2cf28e88e-CMH
connection: close
content-type: text/html; charset=UTF-8
date: Sun, 23 Aug 2026 12:43:15 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
referrer-policy: same-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9Kk6%2FV8mnncJXAgWK%2Fj9u3oovkeNgYkfvZJIbjP75v%2FXU%2FNHUMlIyyKIV195hRzMom8TEllpSUcDOGrQk7qbgpYCiHgETUbDksvY6IHQfiZKEPmR29rU7yuHC5cuKhMJEL8jgalbbWajjfVBYPTdij8%3D"}]}
server: cloudflare
transfer-encoding: chunked
x-frame-options: SAMEORIGIN
CORS tester was built by @mscccc. The code is available on GitHub. Sponsored by HTML/CSS to Image.