If you need access to the users data on another service, without having their credentials on the other service, CORS is the correct choice.
> Servers can also notify clients whether "credentials" (including Cookies and HTTP Authentication data) should be sent with requests.