AJAX Request header field X-Secret is not allowed by Access-Control-Allow-Headers.

$.ajax({
        type: 'POST',
        crossDomain: true,
        beforeSend: function(xhr) {
            xhr.setRequestHeader('Authorization', 'Token токен');
            xhr.setRequestHeader('X-Secret', 'секретный');
        },
        url: 'https://dadata.ru/api/v2/clean/phone',
        contentType: 'application/json',
        data: '+8314545445 доб 11'
    })
    .fail(function(jqXHR, textStatus, errorThrown) {
        alert("Ошибка: " + errorThrown);
    })
    .done(function(data) {
        debugger;
        alert(data);
    });