I added the necessary header to the api server and then changed the content type of the request to text/plain to disabled the preflight OPTIONS request which the server was erroring on.
Not sure about the security of all this but it's a very basic website and I don't think it'll be an issue.