Your headers are being added twice. When this happens they get merged together and that's probably creating an invalid final value. I'm guessing you've tried to configure the same CORS setup in both Laravel and in Nginx/OpenResty. Removing one of these should fix it

When you check your request in the network tab of your browser, you want to see these headers and no duplicates

1
Access-Control-Allow-Origin: https://elkj-pos.vercel.app
2
Access-Control-Allow-Credentials: true

Alternatively: the easiest way to get around CORS is to not make any cross-origin requests in the first place.

• If you're using a full stack framework like Next.js, you can route your requests through the same-origin Next.js backend toward your API. This might feel like an extra step, but server -> server requests are much faster than client -> server as they're between (or within) datacenters.
• You could also use proxy rewrites to route traffic from your app domain to your Laravel Server. We use this to mix Next.js pages into the Discourse platform on this website. https://vercel.com/blog/how-we-run-vercels-cdn-in-front-of-discourse#vercel-as-a-cdn

Both of those solutions mean your website is only ever sending requests to its own domain, which eliminates CORS and allows you to use more secure authentication methods like HttpOnly SameSite cookies.