now.json

{
  "version": 2,
  "env": {
    "INFURA_API_KEY": "@infura-api-key"
  },
  "build": {
    "env": {
      "INFURA_API_KEY": "@infura-api-key"
    }
  },
  "headers": [
    {
      "source": "/(.*)",
      "headers" : [
        {
          "key" : "Vary",
          "value" : "Accept-Encoding"
        },
        {
          "key" : "X-Content-Type-Options",
          "value" : "nosniff"
        },
        {
          "key" : "X-Frame-Options",
          "value" : "DENY"
        },
        {
          "key" : "X-XSS-Protection",
          "value" : "1; mode=block"
        },
        { "key": "Access-Control-Allow-Credentials", "value": "true" },
        { "key": "Access-Control-Allow-Origin", "value": "*" },
        { "key": "Access-Control-Allow-Methods", "value": "GET,OPTIONS,PATCH,DELETE,POST,PUT" },
        { "key": "Access-Control-Allow-Headers", "value": "X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version" }
      ]
    }
  ]
}