How do I get around CORS?

Whenever I use Postman or curl or pretty much anything other than a production codebase to send a token request according to the documentation (to https://www.humanity.com/oauth2/token.php), I get the token back, no problem. But when I try from the browser, I always hit the CORS response saying "no CORS header is present on the requested resource).

I've added my app's URL anywhere I can possibly find to do so in my app's settings. I've also looked at the JavaScript SDK, but it doesn't seem to use the API the same way as the documentation says. I can get it working, but it only returns my employee info; it doesn't allow for clock in/out or breaks functionality (which is my goal with this app; to build a clock in/out / take a break function into an internal company app).

Somebody please tell me how I can use the API as described here from an app/browser URL without running into a CORS block: https://platform.humanity.com/docs