Why the request fails
Your browser origin can differ from PUBLIC_ORIGIN when using localhost, 127.0.0.1, a private IP or a different port. POST requests are then denied.
Safe development setup
Only on a trusted local environment, set OTP_DEV_MODE=true and COOKIE_SECURE=false in account-api. The fallback only permits matching request Host headers on loopback or private IPs.
Explicit deployment origins
Set ALLOWED_ORIGINS to exact trusted origins including scheme and port, comma-separated. Do not use wildcard origins.
Production policy
In production use an exact HTTPS PUBLIC_ORIGIN, secure cookies, OTP_DEV_MODE=false and normal CSRF checks.