CORS helps STAC work well, API's should enable it. See https://github.com/radiantearth/stac-spec/issues/888