Core answer
Start here. This is the direct spoken answer to practice first.
Overview
CORS controls which browser origins may read cross-origin responses; it is not authentication or server-to-server access control.
I configure CORS globally through MVC or narrowly with @CrossOrigin, declaring allowed origins, methods, headers, exposed headers, credential use, and preflight cache duration. For a failing browser request, I inspect the Origin, the preflight OPTIONS request, requested method and headers, and the response CORS headers. Direct curl can succeed because CORS is enforced by browsers. The API still authenticates and authorizes the actual request separately.