request.js

<script>

  var xhr = new XMLHttpRequest();
  xhr.withCredentials = true;

  xhr.addEventListener("readystatechange", function() {
    if(this.readyState === 4) {
      console.log(this.responseText);
    }
  });

  xhr.open("GET", "https://cors-anywhere.herokuapp.com/https://api.mindbodyonline.com/public/v6/client/clients?limit=100&offset=0");
  xhr.setRequestHeader("Content-Type", "application/json");
  xhr.setRequestHeader("API-Key", "7bba39594b4d460293abdfd64c8eea48");
  xhr.setRequestHeader("SiteId", "-99");
  //xhr.setRequestHeader("Authorization", "{{staffAuthToken}}");

  xhr.send();
  </script>