Access-Control-Allow-Origin: * don't work in POST

I am working in Dribble's API and getting this error message:

XMLHttpRequest cannot load https://dribbble.com/oauth/token?client_id=*&code=*. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:3000' is therefore not allowed access. The response had HTTP status code 401.

I have already tried many different ways to set Access-Control-Allow-Origin = '*' but none of them worked for me, but reading the console.log(res._headers) i can see that it is being defined, i am sending this through a POST request but the header is not working. This one of the ways i have defined in app.js on Express v4 to set the header.

app.all("/", function(req, res, next) {
  res.header("Access-Control-Allow-Origin", "*");
  res.header("Access-Control-Allow-Headers", "Cache-Control, Pragma, Origin, Authorization, Content-Type, X-Requested-With");
  res.header("Access-Control-Allow-Methods", "GET, PUT, POST, OPTIONS");
  res.header("Access-Control-Expose-Headers", "ETag, Link, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset");
  res.header("Access-Control-Max-Age", "86400");
  res.header("Access-Control-Allow-Credentials", true);
  return next();
});

And this is how i am sending the POST request with Axios:

export const postUserOAUTH = code => ((dispatch) => {
  axios({
    url: `https://dribbble.com/oauth/token?client_id=${clientId}&client_secret=${clientSecret}&code=${code}`,
    method: 'post',
    withCredentials: true,
  }).then((response) => {
    dispatch({ type: 'shots', payload: { registerResponse: response.data, token: response.data.access_token } });
    console.log('ok')
  }).catch((error) => {
    dispatch({ type: 'shots', payload: { registerResponse: error.message } });
    console.log('error')
  });
});

via Hugo Nasciutti