Simple Laravel API (With no Authentication) gets CORS blocked

I have the following installed: Laravel 11, Livewire 3, Jetstream 5 I have a simple Laravel controller:

class TestController extends Controller
{
    public function index(){
        $data= TestTable::all();
        return response()->json($data);
}

I then have created a Cors Middlware in Http/Middleware for Laravel:

class Cors
{
    public function handle(Request $request, Closure $next)
    {
        if ($request->isMethod('OPTIONS')) {
            return response()->json('{"method":"OPTIONS"}', 200, $this->getHeaders());
        } else {
            $response = $next($request);
            foreach ($this->getHeaders() as $key => $value) {
                $response->header($key, $value);
            }
            return $response;
        }
    }

    private function getHeaders(): array
    {
        return [
            'Access-Control-Allow-Origin' => '*',
            'Access-Control-Allow-Methods' => 'GET, POST, PUT, DELETE, OPTIONS',
            'Access-Control-Allow-Headers' => 'Content-Type, Authorization, X-Requested-With, X-CSRF-Token',
        ];
    }
}

I then use this in my routes/web.php to make a new middleware group for the Cors file (Its a group, because I want to have multiple routes later on with the same Cors:

Route::middleware([Cors::class])->group(function () {
    Route::get('/apitest', [\App\Http\Controllers\TestController::class, 'index'])->name('apitest.index');

Then on my other website I call for the API like so:

try {
            const response = await fetch('https://laravel-page.plesk.page/apitest', {
                method: 'GET',
                headers: {
                    'Content-Type': 'application/json',
                }
            });
        } catch (error) {
            return `<p>Failed to load branches. Error: ${error.message}</p>`;
        }

Which throws me the error Access to fetch at 'https://laravel-page.plesk.page/apitest' from origin 'https://www.other-website.de' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled. My goal is to simply have a connection, the page doesnt need authorization, it just returns a json response, that all I need for now. The real problem comes when I test it on POSTMAN. I literally just put my Laravel URL and change the request to GET and I get a 200 response, with what I need. So, postman works and here's the default pre-set headers there:

Cookie: XSRF-TOKEN=<random stuff in here > //I havent inserted this here, it was generated automatically by POSTMAN, I have only pasted the URL and changed to GET and I get 200 on send
Postman-Token: <calculated when request is sent>
Host: <calculated when request is sent>
User-Agent: PostmanRuntime/7.34.0
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

I dont think there's something wrong with my Laravel thing, but I dont even know what to change or where to look, the other site is a Ionos website, which is basically like WordPress and I insert the code there by simply adding a HTML element and pasting HTML and JS in there. If Postman works, then surely means I have to change the JS code, but I want to know how to allow Cors Origin directly from Laravel and my frameworks