CORS preflight

The API is server to server, and the preflight says so: a browser preflight is answered with 405 and Allow: POST rather than CORS headers, with an x-orisift-cors header explaining why. That header is also sent under its legacy name, x-truelook-cors, with the same value.

This is a signal, not a security control. Refusing the preflight does not protect an API key that has been embedded in frontend code: such a key is already visible to anyone who views the page or its bundle, and no CORS behaviour can undo that. The refusal only tells you that browser use is unsupported. Keys must be held server-side and never shipped to a client.