Please bear in mind my answer is based on assumptions. If you edit your question to clarify let me know and I'll update my answer.
From your diagram
server.com (web server) —> HTTP JSON API request —> dataStore.net (data server).
it appears that you are connecting to
datastore.net from your server.
However, as you mention CORS, I get the impression that the following diagrams are more accurate:
user —> HTTP request —> server.com
user -> HTTP JSON API request —> datastore.net
Authentication would be needed just for accessing dataStore.net.
This statement adds further weight to my assumption.
If this is the case then your authentication needs to take place on
server.com). Only authenticated requests should be allowed to access the data on
datastore.net. You also mention that you do not wish for users to register. If you want to protect your data on
datastore.net then you must only allow authenticated users to connect, which is why registration is actually neccessary.
The other option is to only allow
server.com to communicate with
datastore.net (first diagram) - i.e. server side access to the API. This means that
datastore.net is effectively a back-end server and does not need to be visible on the internet at all (for inbound traffic other than from