CORS: allow third-party origins for API-key based integrations (or a documented allow-list process)

[webiumsk]

Hi, we're building an open-source Bitcoin Lightning ATM firmware (webiumsk/FIAT-HELL) that uses Flash as a funding source via the public GraphQL API (apiKeyCreate + X-API-KEY auth — works great, thanks!).

We wanted to build a browser-based onboarding wizard (a static page) that helps ATM operators create their API key: userLogin with an SMS code + apiKeyCreate. This currently can't work from the browser because api.flashapp.me/graphql only returns Access-Control-Allow-Origin for Flash's own origins (e.g. pay.flashapp.me); other origins get no CORS headers and the browser blocks the response.

Since the API already supports scoped, long-lived API keys explicitly meant for external integrations, would you consider one of:

1. Allowing CORS on the GraphQL endpoint for third-party origins (auth is via API key / bearer token, not cookies, so reflecting the origin should be safe — there are no ambient credentials to leak), or
2. A documented process to get a third-party origin added to the allow-list?

Our current workaround is to run the key-creation flow on the ESP32 device itself, which works but makes the onboarding flow harder to iterate on.

Happy to provide more details or test against a staging endpoint.