Hi Praven,

From the description on this you are trying to do a Cross Domain request and its getting blocked by the browser, the request is sent to a different domain than your page is on, this is getting blocked due to browser security which only allows requests with the same origin. This is covered with Cors, the above link. As far as Okta Cors goes this is covered with in Security > API > Trusted Origins, although this is not the case, since the requests get blocked in the client (browser).

Basically Cords headers have to be added to the backend server to allow cross origin access.

The is also a solid article on stackoverflow.com/questions/20035101/why-does-my-javascript-get-a-no-access-control-allow-origin-header-is-present

You could test it out with disabled browser security, although a code statement for the Access-Control-Allow-Origin would probably work best.

I hope this puts you on the right path in getting things going and having your script working.

Hi Valeriu, thanks very much for the response. Sorry, I may have missed a few details in the question

My request had these headers:

1. Access-Control-Request-Headers: cache-control,if-modified-since,pragma
2. Access-Control-Request-Method: GET
3. Origin: https://gnc-integration.enspirecommerce.com

I have added a trusted origin in the place you mentioned:

Security > API > Trusted Origins

But, even then the response doesn't have the Access-Control-Allow-Origin header from okta.

I'll go through the article to check if I missed something, but, would appreciate if you had some quick feedback.