until WP-API/WP-API#144 is fixed, here is a standalone plugin that will enable CORS
You might want to restrict responses by running a string comparison of your get_http_origin() result.
please note that I'm not actively maintaining this project. consider switching to https://github.com/thenbrent/WP-API-CORS for a better experience. Thanks!
cd wp-content/plugins
git clone https://github.com/bjoernklose/wordpress-api-cors.git wp-json-api-cors
- (if you have the excellent wp-cli installed
wp plugin activate wp-json-api-cors