angular headless issues

I’m trying to run drupal headless using it’s restful api. I’ve hit a brick wall now.
I’ve been able to login and logout on my angular app, but no other api calls work. I’ve tried out api calls through postman and vscode restclient and got them to work there. As best I can tell these use a cookie so I can’t do any api calls in my angular web app.
I’ve enabled CORS, RestUI, and a bunch of other things. I’m trying to run my web app on a separate domain from my drupal website, this may be what is giving me my CORS issues. I can’t figure out how to do the user or basic_auth unless that’s using the X-CSRF-Token. Please help.

Drupal version: 


Source: https://www.drupal.org/taxonomy/term/4/feed