You’re close!
It’s: https://api.spark.io/devices/DEVICEID/VARIABLE?access_token=ACCESSTOKEN
There’s good examples at http://docs.spark.io/#/api/reading-data-from-a-core-variables. I can attest that it works great using jQuery’s $.get(), $.post(), and $.ajax() methods with no CORS issues.