Apologies @gray-kilobyte-89541 , you are right it is the cy.visit that is doing the magic where it is changing the URL to the app's URL. I'm still unsure how this is working - I am able to use a cy.intercept to intercept a call to a login function and return an expected scope. I don't understand how this bypasses CORS, if you have any information that would be great thanks