What is an Access-Control-Allow-Credentials header?

Tells the browser whether the response can be shared when the request was made with credentials (cookies, auth).