if the server has been configured to allow cross-domain, you can try this method:

axios({
    method: '$method',
    url: '$url',
    data:{
        param:'$params'
    },
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Access-Control-Allow-Origin': *,
    }
}).then(function(res){
    return res.data;
});

give it a try?

as mentioned above, this kind of business with excessive privacy is best carried out on the server side, and the client side can just take the response.

Let the backend get

but it can be opened in the browser address bar and access_token can be obtained

there is no cross-domain when you open it directly. And Wechat API needs to initiate a request in the background, otherwise your appid,secret may leak

Cross-domain allows your backend to retrieve the request