CORS error embedding Genesys Messenger in Next.js App Router

Trying to drop the Genesys Cloud Messenger widget into a Next.js 14 App Router project. Getting a CORS block on the initial handshake request to https://api.mypurecloud.com.

Access to XMLHttpRequest at 'https://api.mypurecloud.com/api/v2/...' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I’ve whitelisted the origin in the Org Settings, but the browser still rejects it. Is the SDK making an extra pre-flight call that’s failing? Using the standard <script> tag injection method.