Here is a bit more info. The following fails:

            $.ajax({
                type: "GET",
                url: "https://api.digitalocean.com/v2/droplets",
                crossDomain: true,
                contentType: 'application/json',
                beforeSend: function (xhr) {
                    xhr.setRequestHeader ("Authorization", "Bearer <MY TOKEN>");
                },
                error: function (jqXHR, textStatus, errorThrown) {
                    console.log(textStatus)
                },
                success: function (data) {
                    console.log("Yay!")
                }
            });

But running in curl succeeds:

curl -H "Origin: http://localhost:3000" -H "Authorization: Bearer <MY TOKEN>" -H "Content-Type: application/json" -X GET "https://api.digitalocean.com/v2/droplets"

Hey @sconrad, we are looking into this internally and will share an update with the Community here once we have one :)