[wefarrell]

Access-Control-Allow-Credentials too and it needs to be configured on both the client and the server.

[zelly]

If the API is not yours, why not set up a proxy on your domain (where you can change the origin header)? Envoy, nginx, etc.