CORS is a browser rule that controls which origins can read responses from your API via JavaScript. It’s not authentication and it doesn’t stop someone from calling your API from a server or tools like curl. You still need proper auth/authz and input validation on the server.