API Access-Control-Allow header

$response = $response->withHeader('Access-Control-Allow-Origin', "*");
$response = $response->withHeader('Access-Control-Allow-Credentials', 'true');
return $response->withHeader('Access-Control-Allow-Headers', 'X-Requested-With,
Content-Type, Accept, Origin, Authorization, X-Authorization-JWT, X-CSRF-Token')
->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');