Based on the response you’re getting it seems like Access-Control-Allow-Credentials = true is already set and causing the warning that Access-Control-Allow-Origin can’t be set to the wild card. I don’t think it’s documented anywhere but you can try setting the database property cors.allowed.origins to the site that you’d like to allow access from.