cors blocking keycloak auth endpoint in express server middleware

Question

I'm getting a cors error when trying to calling a keycloak.protected endpoint. I'm calling it from a svelte front-end app. The middleware is running on an express server.

Here's the full project code:

front-end: https://github.com/roberttootill98/keycloak-client

server: https://github.com/roberttootill98/keycloak-server

The request works fine when using the bearer token obtained by the front end in postman.

Here's the full error: Full cors error

Here's the keycloak access settings: Keycloak access settings