title: How do some API services accept Authorization headers from all origins?
body: <p>Stripe/Square/etc allow you to put your API key in an <code>Authorization</code> header as a <code>Bearer</code> token. However, from what I understand, you can't allow credentials (which includes the <code>Authorization</code> header) from all origins. So how are they accepting requests with that header from all origins?</p>