CORS block on Messenger widget init in Next.js

Trying to mount the CXone Messenger widget in a Next.js 14 app. The script tag loads fine, but the initial handshake to the DFO gateway gets blocked by the browser.

Access to fetch at 'https://webchat.nice-incontact.com/api/v1/messaging' from origin 'https://localhost:3000' has been blocked by CORS policy

The widget expects a specific header or origin whitelist that I’m not seeing in the docs. How do you configure the allowed origins for the embedded script?