Don’t have an answer for you… just here to say that the WordPress StackOverflow site might be a good place for fairly advanced and developer-focused questions like this.

https://wordpress.stackexchange.com/

Good luck!

add_action( 'init', 'handle_preflight' );
function handle_preflight() {
	
	$origin = get_http_origin();
 	if ( $origin == 'https://localhost:8080' ||	$origin == 'https://yourapp.firebaseapp.com') {
		// You can set more specific domains if you need
    	header("Access-Control-Allow-Origin: " . $origin);
		header("Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE");
		header("Access-Control-Allow-Credentials: true");
		header( 'Access-Control-Allow-Headers: Authorization' );

		if ( 'OPTIONS' == $_SERVER['REQUEST_METHOD'] ) {
			status_header(200);
			exit();
		}
	}
}

Wordpress back end JWT authentication
Android or Apple App

I have an Endpoint POST

register_rest_route($this->namespace, ‘/’ . $base.’/crmvalidation’, array(
array(
‘methods’ => \WP_REST_Server::CREATABLE,
‘callback’ => array( $this, ‘customer_validation’ ),
‘permission_callback’ => array( $this, ‘current_user_is_online’ ), //register_user_permissions_check
‘args’ => $this->get_endpoint_args_for_item_schema( true ),
),
) );

———–

the problem is that the first method method to invoke is the OPTIONS not the GET