Stripe/Square/etc allow you to put your API key in an Authorization header as a Bearer token. However, from what I understand, you can't allow credentials (which includes the Authorization header) from all origins. So how are they accepting requests with that header from all origins?
I think they just set
Access-Control-Allow-Origin: *
from their server