A browser API request succeeds from a command-line client but fails CORS checks. The browser sends a preflight request and the API uses credentials. Which correction is appropriate?

1. Return only Access-Control-Allow-Origin: * and assume it authorizes all credentialed browser requests.
2. Change only the command-line client timeout.
3. Disable API authentication because CORS is a substitute for identity verification.
4. Configure the required preflight and actual-response headers for the allowed origin, methods, headers, and credential behavior.