Почему не разрешает заголовок X-MBX-APIKEY? Как можно решить проблему не отключая протоколы безопасности в браузере?

Question

[Aspirant555]

ourRequest.open('GET', url, true);
ourRequest.setRequestHeader("Access-Control-Allow-Origin", "*");
ourRequest.setRequestHeader("Access-Control-Allow-Credentials", "true");
ourRequest.setRequestHeader("Access-Control-Allow-Methods", "GET,HEAD,OPTIONS,POST,PUT");
ourRequest.setRequestHeader("Access-Control-Allow-Headers", "Access-Control-Allow-Headers, X-MBX-APIKEY, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers");
ourRequest.setRequestHeader('X-MBX-APIKEY',keys['akey']);

Ошибка:

from origin 'https://site.test' has been blocked by CORS policy: Request header field x-mbx-apikey is not allowed by Access-Control-Allow-Headers in preflight response.