My frontend and backend services are in different origins, hence problem with CORS. But in my backend (python fastAPI) I have already added allow all origins:

api.add_middleware(
    CORSMiddleware,
    allow_origin_regex=".*",
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

This is how my frontend is making the call

fetch('https://someurl.com/call', {
        method: 'POST',
        headers:{
            'Content-Type': 'application/x-www-form-urlencoded',
            'Signature': btoa('0000')
        },
        body: new URLSearchParams({

        })
    }).then(res => {
        return res.json()
    })

Error that I am getting:

Access to fetch at 'https://someurl.com/call' from origin 'https://frontend.com' has been blocked by CORS policy: Request header field signature is not allowed by Access-Control-Allow-Headers in preflight response.

Is there something I am missing? Is my custom header 'Signature': btoa('0000') the problem?

I am trying to debug, this is what I am getting from the browser console