javascript - AJAX function w/ Mailgun, getting "ERROR Request header field Authorization is not allowed by Access-Control-Allow-Headers" -

i'm working on making ajax call hit mailgun api send email. documentation on mailgun says post requests should made "https://api.mailgun.net/v3/domain.com/messages". i've included api key specified mailgun (they instruct use username of 'api'). since involves cors, can't past error: request header field authorization not allowed access-control-allow-headers.

however, i've inspected requests/responses in network tab , "access-control-allow-origin" in response mailgun set "*"...which should indicate should allow it? (see request/response below): i've edited actual domain , api key.

remote address:104.130.177.23:443 request url:https://api.mailgun.net/v3/domain.com/messages request method:options status code:200 ok request headersview source accept:*/* accept-encoding:gzip, deflate, sdch accept-language:en-us,en;q=0.8 access-control-request-headers:accept, authorization access-control-request-method:post connection:keep-alive host:api.mailgun.net origin:null user-agent:mozilla/5.0 (macintosh; intel mac os x 10_9_4) applewebkit/537.36 (khtml, gecko) chrome/40.0.2214.115 safari/537.36 response headersview source access-control-allow-headers:content-type, x-requested-with access-control-allow-methods:get, post, put, delete, options access-control-allow-origin:* access-control-max-age:600 allow:post, options connection:keep-alive content-length:0 content-type:text/html; charset=utf-8 date:fri, 20 mar 2015 19:47:29 gmt server:nginx/1.7.9  

my code ajax call below, in include credentials in headers , domain post supposed go. not sure what's causing not work. because i'm testing on local host? didn't think make difference since "access control allow origin:*" in response header. appreciated! thank you.

function initiateconfirmationemail(formobj){    var mailgunurl;   mailgunurl = "https://api.mailgun.net/v3/domain.com/messages"   var auth = btoa('api:myapikeyhere');      $.ajax({     type     : 'post',     cache    : false,     headers: {"authorization": "basic " + auth},     url      : mailgunurl,     data     : {"from": "emailhere", "to": "recipient", etc},      success  : function(data) {       somefunctionhere();     },     error  : function(data) {       console.log('silent failure.');     }   });   return false; } 

drazisil correct above. response needs include access-control-allow-headers: authorization including header in request , authorization not simple header.