How does the `Access-Control-Allow-Credentials` header affect CORS errors?

The `Access-Control-Allow-Credentials` header is used when you need to send cookies or authorization headers with a cross-origin request. If you're sending credentials, the client-side JavaScript must include `credentials: 'include'` in the fetch options. On the server side, `Access-Control-Allow-Credentials` must be set to `true`. Crucially, if `Access-Control-Allow-Credentials` is set to `true`, the `Access-Control-Allow-Origin` header cannot be a wildcard (`*`); it must specify the exact origin.