Headless Customer Accounts API integration ngrok cors error

Hi friends, I have asked this over on partner support, but I figure I might as well ask here too while I’m waiting for reply.

I have a custom headless storefront. I was able to integrate most of the features of B2B with the admin api, but I wasn’t able to keep the customer authenticated for the handoff to checkout, so I’m integrating the Customer Accounts API as well.

The problem is the second step in the authentication process, the call to
shopify.com/{{ my store id }}/auth/oauth/token is returning 401 unauthorized with a cors error. I am using a ngrok tunnel (and also tried using a live local link generated with the netlify cli and got the same result). The ngrok domain is listed in my javascript origin, and the specific callback endpoint is listed as a callback URI. I’ve tried using my /account page, and my root domain for the callback. I get the same cors error in every case.

Hopefully someone else has run into this and has some guidance toward a fix.

Thanks in advance.

Partner support referred me to the authentication and access discussion board so I’m moving this question over there: https://community.shopify.com/post/2555502