CORS errors are caused by making API requests from a domain that's not in your configured redirect URIs for the oauth client (not likely with the dev tools) or the API request is malformed in such a way that it's not hitting the API and therefore won't have CORS headers to the response. Try making the exact same request using the same auth token outside of a browser and see what the response is; only browsers enforce CORS.
Responses blocked by CORS can sometimes have more details on the error if you open the network tab in your brower's developer tools. I've seen before where server side errors from the API will not contain the CORS headers so the browser thinks in was blocked. When a CORS issue comes up, you can't access the response body from JS so the dev tools can't provide any additional info, but looking at the response body in the browser dev tools can get you those additional details