No 'Access-Control-Allow-Origin' header is present on the requested resource even though there is?

I'm trying to make a POST request from https://www.example.io (client) to https://api.example.io (server) which has this CORS configuration:

app.use(
  cors({
    origin: https://www.example.io
    credentials: true,
    maxAge: 86400,
    allowedHeaders:
      "Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Cookie, Host, Access-Control-Request-Method, Access-Control-Request-Headers",
    methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS", "HEAD"],
  })
);

The origin header is not only present but matches the origin domain.

Exact error message:

Access to XMLHttpRequest at 'https://api.example.io/application/create' from origin 'https://www.example.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Any help would be greatly appreciated.