swagger security oauth2 authorisation code workflow request headers

Hi

In your case I might suggest you 2 solutions:

1. Use proxy mode. You can enable proxy settings in the bottom of your specification on SwaggerHub OpenAPI editor page. Here is an image for clarification.
2. If you route the request via browser, then you should allow CORS requests in the configuration of your server. CORS uses special HTTP headers to allow cross-domain requests. The "try it out" feature requires the following headers in API responses:

Access-Control-Allow-Origin: https://app.swaggerhub.com
Vary: Origin

Since you are sending request from SwaggerHub, the origin value is https://app.swaggerhub.com

If you are expecting a request from any origin while using a wildcard in the response header, you should disable credentials on SwaggerHub OpenAPI editor page (check the bottom settings in the previous screenshot).

Also, I would like to recommend you the this article on CORS to get into SwaggerHub.