API Project CORS - for Mobile App - help!

I’m trying to set up a new Mobile App to connect to an existing web project and am going round in circles a little.

It appears that CORS needs to be enabled for external devices to be able to use the endpoints. I have enabled it in the web project but if you use * you can’t use the ‘credentials’ attribute so it fails to set the log in cookie. But then each device type seems to use a different value for the origin:
Web: http:localhost:PORTNUMBER (primarily used to test)
IOS: capacitor://localhost
Android: http:localhost

How should it be set up on the WEB API project to allow login/security provider but still cope with each device?