When I tested my WKD services with https://wkd.dp42.dev/, I received an error message saying that the Access-Control-Allow-Origin header was not set to *. It doesn't seem to cause a problem now, but it's better to be safe than sorry.