// In file: app/Http/Kernel.php
protected $middlewareGroups = [
    'web' => [
        // ...
    ],

    'api' => [
        \Illuminate\Http\Middleware\HandleCors::class, // <-- ENSURE THIS LINE IS UNCOMMENTED
        'throttle:api',
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
];