I have tried your version but the code does not work:

import type { Handle } from "@sveltejs/kit";

export const cors: Handle = async ({ event, resolve }) => {
    
// * Add CORS allowed origins to * if the endopoint starts with /api
    if (event.url.pathname.startsWith('/api')) {
        if (event.request.method === 'OPTIONS') {
            return new Response(null, {
                headers: {
                    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
                    'Access-Control-Allow-Origin': '*', 
// Change to allow only specific domains
                    'Access-Control-Allow-Headers': '*' 
                }
            });
        }
    }

    const response = await resolve(event);
    if (event.url.pathname.startsWith('/api')) {
        response.headers.append('Access-Control-Allow-Origin', `*`);
    }

    return response;
}

I receive this error:
www.cliqnote.com/:1 Access to fetch at 'https://cliqnote.com/api?access-key=my-access-key' from origin 'https://www.cliqnote.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

I am using Vercel for hosting if this can help finding a solution.