If a POST request works in Postman but fails in a browser, one usual suspect is misconfigured CORS. Postman doesn't send OPTIONS preflight requests, but browsers do. Does the server sends a correct Access-Control-Allow-Origin header?