Welcome to the community, @John_Hinkel! Thanks for reaching out.
Maybe I'm misunderstanding, but it sounds like you're trying to hit the https://retool.example.com/api/embed-url/external-user endpoint via a XHR request from your browser. If that's the case, the error you're seeing is the expected and correct behavior, as doing so would expose your API key to the client.
Depending on your specific use case, it might be sufficient to generate a static pre-authenticated URL that you can embed. Do you need to uniquely identify users in your Retool app?
There can be a lot of nuance in cases like this and, given the fact that you're facing an imminent launch, it might make sense for you to join our community Office Hours if you're able! I'd be happy to help you work through this. 