I have an api endpoint, and I want it to be accessible from any domain name (everyone can use it from web on their domains).

import { NextApiResponse } from "next";
import { NextResponse } from "next/server";
import path from "path";
import { promises as fs } from "fs";

export async function POST(req: Request) {
  const response = Response.json({ data: "test" }, { status: 200 });
  /*...*/
  response.headers.set("Access-Control-Allow-Origin", "*");
  response.headers.set("Access-Control-Allow-Methods", "*");
  response.headers.set("Access-Control-Allow-Headers", "*");
  return response;
}

export async function OPTIONS(request: Request) {
  const allowedOrigin = request.headers.get("origin");
  const response = new NextResponse(null, {
    status: 200,
    headers: {
      "Access-Control-Allow-Origin": allowedOrigin || "*",
      "Access-Control-Allow-Methods": "*",
      "Access-Control-Allow-Headers": "*",
    },
  });

  return response;
}

It works when I run it on localhost and try to access it from another chrome tab.
But when I host it on Vercel and try to access the api from another domain, I get the following

“next”: “14.2.3”, “react”: “^18”,
Is there any way to disable CORS for this api endpoint? Thanks.