elsa-core | A .NET workflows | BPM library

It looks like you trying to implement some kind of machine-to-machine interaction.
In this case you can consider using client credentials flow instead of authorization code flow which you are currently using.
That means you need to add another client into IdentityServer4 config with corresponding settings. And then instead of passing your frontend's accessToken everywhere you start using new IdentityServer client, server-side one in this particular case.

Talking about disadvantages. Well, most likely you need some information about current user and your new server-side accessToken won't have such kind of details inside (because it's not a user who is starting a process here, but a service).
In this case I might suggest adding another method or controller with some new parameters like userId, for example. This method or controller can be made accessible from only specified IdentiyServer4 clients through policies.

Make sure to update your Startup class to:

1. Add CORS services, and
2. Add CORS middleware.

As you already figured out, make sure to add the CORS middleware component before the call to app.UseHttpActivities() (which is the middleware handling HTTP workflow requests).

Sample code in ConfigureServices: