### Expected behavior
Clients appear in the clients list at https://api.wikimedia.org/wiki/Special:AppManagement when logged in to both the API Portal and Meta. This behavior works as expected in the beta cluster.
### Observed behavior
Clients do not appear in the client list, giving this error:
```
Access to XMLHttpRequest at 'https://meta.wikimedia.org/w/rest.php/oauth2/client?limit=5&oauth_version=2&sort=%7B%22property%22%3A%22registration%22%2C%22direction%22%3A%22DESC%22%7D' from origin 'https://api.wikimedia.org' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
load.php?lang=en&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets|skin.wikimediaapiportal.scripts&skin=wikimediaapiportal&version=1suhe:133
GET https://meta.wikimedia.org/w/rest.php/oauth2/client?limit=5&oauth_version=2&sort=%7B%22property%22%3A%22registration%22%2C%22direction%22%3A%22DESC%22%7D net::ERR_FAILED
```
This is the same error we get in the beta cluster when encountering T264637. Interestingly, calling the endpoint directly in the browser (https://meta.wikimedia.org/w/rest.php/oauth2/client?limit=5&oauth_version=2&sort=%7B%22property%22%3A%22registration%22%2C%22direction%22%3A%22DESC%22%7D) does work.