Getting 401 on API but working with postMan

Question

I have this API:

            const url = url;
            const headers = new Headers({
                "Content-Type": "application/json",
                "Accept": "application/json", // change to application/javascript for jsonp
                "Access-Control-Allow-Credentials": true,
                "Access-Control-Allow-Origin": true,
                "access_token": accessToken,
                "id_token": idToken,
            });
            const options = {
                method: "GET",
                headers: headers,
                credentials: "same-origin",
                mode: "no-cors"
            };

            fetch(url, options)
            .then(function(response) {
                console.log('-working: ',response.json());
            })
            .catch(function(error) {
                console.log('-error: ',error);
            });

Having the same API on postMan this works like a charm there but on my code I always get 401 (Unauthorized).

Also if I remove "no-cors" I get a 401 plus CORS issue

Answer 1

CORS needed to be added as an additional header on the back end