If you can install gsutil that can be a good way to manage your CORS configuration as documented here. Otherwise, I'd recommend using Google's OAuth 2 playground to access their REST API and manage your CORS settings that way (more docs!)
Typically, though, if you're running into a CORS error that should be visible in your browser console if it's not showing up in Retool. That's a good place to check but, as you mentioned, if you haven't set up CORS for your bucket it's likely something you'll need to do either way.
Is there any particular part of the setup process that you're having trouble with?