Didn't resolve the CORS error from my Python cloud function

Question

I create python backend for the frontend calling API, but it seems like the CORS error didn't resolve from the backend!

This API working fine in the postman and in the testing tab of the GCP,but give error in the browser(Error added below!)

I create this script for my cloud function GCP:

import os
import ast
import re
import requests
import numpy as np
import onnxruntime as rt
import torch
from google.cloud import storage
from transformers import DistilBertTokenizer
import openai
import sys
import functions_framework
from flask import Flask, request
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

model = None
tokenizer = None
dl_dir = "/tmp"
storage_client = storage.Client()
bucket = storage_client.get_bucket("python_punctuation")

def download_model():
    global model, tokenizer
    if model:
        return
    if not os.path.exists(dl_dir):
        os.makedirs(dl_dir)
    i = 0
    for blob in bucket.list_blobs(prefix="Notes_capture/", delimiter="/"):
        destination_uri = os.path.join(dl_dir, blob.name)

        if i==0 and not os.path.exists(destination_uri):  ### Create folder for /tmp/Notes_capture/
            os.makedirs(destination_uri)
            i = i+1
        else:  ### Else download all the model and tokenizers
            blob.download_to_filename(destination_uri)

    model_path = os.path.join(dl_dir,"Notes_capture", 'action_items.onnx')
    model = rt.InferenceSession(model_path, providers=['CUDAExecutionProvider', 'CPUExecutionProvider'])
    tokenizer = DistilBertTokenizer.from_pretrained(os.path.join(dl_dir,"Notes_capture"), do_lower_case=True)
    return model, tokenizer

class predict_actions:
    def __init__(self, model, tokenizer):
        self.model = model
        self.tokenizer = tokenizer

    def predict(self, input_text):
        text = input_text
        padded_sequence = self.tokenizer(text, padding='max_length', max_length=128, truncation=True, return_tensors="pt")
        input_id = padded_sequence['input_ids'].squeeze(1)
        mask = padded_sequence['attention_mask']
        batch_x = {
            'input_id': input_id.cpu().numpy(),
            'mask': mask.cpu().numpy()
        }
        output = self.model.run(None, batch_x)
        return np.argmax(output[0], axis=1)

    def gpt_response(self, sentence):
        api_key_file = open("/tmp/Notes_capture/Auth_key.txt","r")
        api_key = api_key_file.read()
        api_key = api_key.replace("\n","")
        openai.api_key = (api_key)
        example = {"action_items": "", "roadblocks": "", "conclusion": ""}
        completion = openai.ChatCompletion.create(
        model="gpt-3.5-turbo",
        messages=[
            {"role": "system", "content": "You are capturing notes from the given text paragraph, these all the sentences are the main topics from the converstaion."},
            {"role": "assistant", "content": f"""You are capturing notes from the given text paragraph, these all the sentences are the main topics from the converstaion. action_items, roadblocks(if the service related blockers/issues from the client or the user call conversation/ meeting, else give ""(empty string) in the output), conclusion(conclusion of the conversation), extract all this information from this paragraph only in the Python Dictionary format, please do not specify any kind of chind dictionary in the values of the key(only simple string values), and if in case the value is not detected give ""(empty string), if you can't able to detect anything respond only "" (Python Dictionary Response Example: {example}): {sentence}"""}
        ]
        )
        return completion.choices[0].message['content']

@app.route('/notes_capture', methods=['POST','GET'])
def notes_capture():
    headers = {
        "Access-Control-Allow-Origin": "*",
        "Access-Control-Allow-Methods": "POST",
        "Access-Control-Allow-Headers": "Content-Type",
        "Access-Control-Max-Age": "3600",
        "Access-Control-Allow-Credentials": "true",
    }

    if request.method == "OPTIONS":
        return ("", 204, headers)

    request_json = request.get_json(silent=True)

    if request_json and 'message' in request_json:
        return (request_json['message'], 400, headers)

    global model, tokenizer
    text = request.json
    split_text = text.split(".")
    words = len(re.findall(r'\w+', text))

    action_items = []
    roadblocks = []
    conclusion = []

    if words>40:
        if not model:
            model, tokenizer = download_model()
        predict_class = predict_actions(model,tokenizer)
        action_text = []
        for sentence in split_text:
            action_pred = predict_class.predict(sentence)
            if action_pred == 1:
                action_text.append(sentence)
            else: pass
        
        #create list to paragraph form
        action_para = ". ".join(action_text)
        output = predict_class.gpt_response(action_para)
        output_dict = ast.literal_eval(output)

        action_items.append(output_dict['action_items'] if len(output_dict['action_items'])>0 else None)
        conclusion.append(output_dict['conclusion'] if len(output_dict['conclusion'])>0 else None)
        roadblocks.append(output_dict['roadblocks'] if len(output_dict['roadblocks'])>0 else None)

        final_dict = { "action_items": action_items, 
                    "conclusion":conclusion, 
                    "roadblocks": roadblocks }
        return (final_dict, 200, headers)
    else:
        return ({"error": "Give paragraph as a input"},200, headers)

And get this error if I call this API from google: search:1 Access to fetch at 'https://asia-south1-transcript-extension-lb.cloudfunctions.net/notes_capture' from origin 'https://www.google.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

How to get solution without the flask cors?? Please let me know, what's wrong I did and what I miss in the code??