We had API cached by ClodFront. In the process of troubleshooting we turned it off and we attached frontend directly to API. There should be CORS headers though. The problem was more scalability problem. It's too soon to say for sure, but getting rid of some middleware and scaling Heroku Dynos helped.