When should I really set "Access-Control-Allow-Credentials" to "true" in my response headers?

MDN says, when the credentials like cookies, authorisation header or TLS client certificates has to be exchanged between sites Access-Control-Allow-Crendentials has to be set to true.

Consider two sites A - https://example1.xyz.com and another one is B- https://example2.xyz.com. Now I have to make a http Get request from A to B. When I request B from A I am getting,

"No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://example1.xyz.com' is therefore not allowed access."

So, I'm adding the following response headers in B

response.setHeader("Access-Control-Allow-Origin", request.getHeader("origin"));

This resolves the same origin error and I'm able to request to B. When and why should I set

response.setHeader("Access-Control-Allow-Credentials", "true");

When I googled to resolve this same-origin error, most of them recommended using both headers. I'm not clear about using the second one Access-Control-Allow-Credentials.

1. When should I use both?
2. Why should I set Access-Control-Allow-Origin to origin obtained from request header rather than wildcard *?

Please quote me an example to understand it better.