Ok, that would suggest the Access-Control-Allow-Origin is set to wildcard (*) i.e. code from any origin can access the API. As it states, you can’t have credentials when that is set to wildcard. What do you get if you remove credentials?
fetch("https://external_domain/api", {
method: 'GET',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
'Authorization': 'Bearer ' + [your token]
}
})
.then(response => {
console.log(response.data);
})