How to resolve CORS issues with app APIs from an app embed?

[ripci]

On my app, my backend has custom REST APIs that are usable/used on the admin dashboard, but I also have made some that I want to use to deliver information to an app embed I am making. I need the app embed to be able to fetch the APIs that are hosted on my app. I have all the javascript code on the embed side already.

I understand that in dev mode the app is tunneled through NGROK, but this is causing me CORS issues. 

1. How can I get around this CORS issue?
2. When the app is published, where is the app hosted (what URL, etc)?