CORS is browser-enforced. By default, JavaScript on your site cannot call an API on another domain unless that API sends an Access-Control-Allow-Origin header authorising it. CORS errors are the #1 head-scratcher for junior devs and the fix is almost always server-side.
CORS
Also known as: cross-origin