We’ve explored this further and believe the problem is that UI extensions make an HTTP OPTIONS request, which is not supported by App Proxy. The resulting 405 response is interpreted by the browser as a CORS error. For now the solution is to make direct calls to your own app server without App Proxy as an intermediary. We will investigate fixing this but are still undecided on whether we want to support this combination of App Proxy and Checkout UI extensions.