Setting cookies on Graphql-yoga server throws a CORS error but it isn't

Question

Edit: It definitely isn't actually CORS. It is like it is just ignoring my attempts to write the tokens into cookies... I am also having trouble getting it to throw an error that I can find useful... I will keep throwing darts at the wall until one makes sense.

I have a graphql-yoga server with an apollo client frontend. I am using cookie-parser on the server to store Microsoft Graph authentication tokens in the browser. I am getting an error that shows up as CORS but I can't figure out why.

Access to fetch at 'https://api.mydomain.store/' from origin 'https://mydomain.store' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Error: Network error: Failed to fetch

This is strange because I can make other queries to the server with no CORS issues. I thought it had to do with the way I was setting the options on the cookies, but I think that I am doing that correctly:

//saveCookies
function saveValuesToCookie(token: any, res: Response) {
  // Parse the identity token
  const user: any = jwt.decode(token.token.id_token);

  const isDev = process.env.NODE_ENV === 'development';
  console.log('isDev: ', isDev);

  const cookieOpts: CookieOptions = {
    domain: isDev ? 'localhost' : 'mydomain.store',
    maxAge: 1000 * 60 * 60 * 24 * 365,
    httpOnly: true,
    sameSite: isDev ? 'lax' : true,
    secure: isDev ? false : true,
  };

  // Save the access token in a cookie
  res.cookie('graph_access_token', token.token.access_token, cookieOpts);

  //save the users email to a cookie
  res.cookie('graph_user_email', user.preferred_username, cookieOpts);

  // Save the refresh token in a cookie
  res.cookie('graph_refresh_token', token.token.refresh_token, cookieOpts);

  res.cookie('graph_user_id', user.oid, cookieOpts);

  // Save the token expiration tiem in a cookie
  res.cookie(
    'graph_token_expires',
    token.token.expires_at.getTime(),
    cookieOpts
  );
}

Based on the resources I have seen so far, this seems correct with current browser rules.

So I look at where I am calling the mutation:

//apollo react authorize mutation
const AUTHORIZE_MUTATION = gql`
  mutation($code: String!) {
    authorize(code: $code) {
      id
      email
      displayName
      studentFaculty
    }
  }
`;

function AuthorizePage() {
  const router = useRouter();

  const { code } = router.query;  //grab the code from the query params

  const [authorize, { loading }] = useMutation(AUTHORIZE_MUTATION, {
    variables: { code },
    // refetchQueries: [{ query: ME_QUERY }],
    onError: (error) => {
      console.error(error);  //**this is where the CORS error originates**
      return Router.push('/');
    },
    update: (_, { data }) => {
      console.log(data);   //** never gets this far **
    },
  });

  useEffect(() => {
    if (router.query.code) {
      authorize();
    }
  }, [router.query]);

  if (loading) return <Loading />;

  return <Loading />;
}

I am at a loss. Can anyone spot what is wrong or point me towards other places to look? The hardest part for me is that the code works perfectly on localhost serving client on port 3000 and server on port 4000. I don't think this error is a genuine CORS issue because of the fact that I can make unauthenticated queries no problem.

Thanks for your time!