Why does the browser block it?
A web page follows the same-origin policy. For cross-origin fetch calls, the target server must grant access with CORS response headers. Some methods and headers cause the browser to send an OPTIONS preflight first. If that check fails, the actual request may never be sent.
Why cURL is different
cURL is not subject to browser CORS rules. A successful terminal command proves that the endpoint is reachable from that machine, not that a web page may read its response. Browsers also control headers such as Host and Cookie, and an HTTPS page may be blocked from calling an insecure HTTP target.
How to debug
Inspect the browser’s Network panel for the preflight request, target origin and response headers. Confirm that Access-Control-Allow-Origin and the permitted methods and headers match the request. Do not use fetch mode no-cors as a workaround: it produces an opaque response whose status, headers and body the page cannot inspect. If the target API cannot enable CORS, use a trusted local client or an appropriately secured relay.