How I do do a fetch request with custom headers to a 3rd party API?

I think ‘client-id’ and ‘client-secret’ should be on the body of the request, and the header has to have an ‘Authorization’ bearer if it is needed.

You can read more about it here: Cross-Origin Resource Sharing