Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Browsers enforce CORS against the exact public origin and preflight response. A domain change can expose differences in scheme, host, port, allowed headers, credentials, cookies, redirects, or proxy behavior that server-side tests do not exercise.
I would inspect the browser network tab and identify the exact origin, method, headers, and preflight response. Then I would compare that origin to the API CORS configuration, including scheme, host, and port. If the API moved behind a custom domain or proxy, I would verify the public URL that the browser is actually calling. I would avoid using wildcard CORS with credentials as a production fix.