I missed this when I first looked at the screenshot of your code:
mode: 'no-cors'
I’m not familiar with Angular apps, but it looks like you’re trying to make an authenticated API request to Discourse from the client. I’m not sure where it happens in the Discourse code, but my understanding is that Discourse blocks admin API requests that are made from the client. This is because there’s no way to make the request without exposing the API key on the client. Related to that, you should change your API key now.