Adding for anyone looking for the fix: app/Http/Kernel.php add 'cors' => \Barryvdh\Cors\HandleCors::class, to the protected $routeMiddleware array.