By default, ArcGIS portals (including ArcGIS Online) allow cross-domain requests using Cross-Origin Resource Sharing (CORS).

If your portal has the default Organization | Settings | Security | Allow Origins settings, you do not need to do anything.

However, if you have modified the Organization | Settings | Security | Allow Origins settings from the defaults, you must configure those settings and add the Inline Designer as an allowed origin.

For details, see Restrict cross-domain requests to your portal.