Access-Control-Allow-Headers no funciona en laravel 7

Question

Tengo una aplicación donde en una vista necesito usar el siguiente código

<script>

var config = {
  method: 'get',
  url: 'https://www.example.com',
  headers: { 
    'X-Secret-Key': 'secret'
  }
};

axios(config)
.then(function (response) {
  console.log(JSON.stringify(response.data));
})
.catch(function (error) {
  console.log(error);
});

</script>

como ven es por axios , en la consola me sale "Access to XMLHttpRequest at "https://www.example.com' from origin 'http://localhost' has been blocked by CORS policy: Request header field x-secret-key is not allowed by Access-Control-Allow-Headers in preflight response.", mi config/cors.php tiene la siguente configuración

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Cross-Origin Resource Sharing (CORS) Configuration
    |--------------------------------------------------------------------------
    |
    | Here you may configure your settings for cross-origin resource sharing
    | or "CORS". This determines what cross-origin operations may execute
    | in web browsers. You are free to adjust these settings as needed.
    |
    | To learn more: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
    |
    */

    'paths' => ['api/*'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => false,

];

que tengo que hacer para que no me siga apareciendo ese mensaje en la consola y me cargue correctamente la información