when youre working on a API and every testCase is all green plus manual testing thru Postman extension is all good..

then makes a web app use that API, authorization works as intended but the token is immedially invalid...

just..how..

CORS?

@fyroc
thats my thought tho..
what i have checked is,
nginx config (permissive), tried taking off the cors middleware on my API, no luck.

tried forcing request to be send with allow headers with *, only triggered preflight denied response in dev tools