diff --git a/cmd/api/main.go b/cmd/api/main.go
index 4077a09..992ddb2 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"flag"
 	"os"
+	"strings"
 	"sync"
 	"time"
 
@@ -45,6 +46,9 @@ type config struct {
 		password string
 		sender   string
 	}
+	cors struct {
+		trustedOrigins []string
+	}
 }
 
 func openDB(cfg config) (*sql.DB, error) {
@@ -93,6 +97,11 @@ func main() {
 	flag.StringVar(&cfg.smtp.password, "smtp-password", "d8672aa2264bb5", "SMTP password")
 	flag.StringVar(&cfg.smtp.sender, "smtp-sender", "Greenlight <no-reply@greenlight.net", "SMTP sender")
 
+	flag.Func("cors-trusted-origins", "Trusted CORS origins (space separated)", func(s string) error {
+		cfg.cors.trustedOrigins = strings.Fields(s)
+		return nil
+	})
+
 	flag.Parse()
 
 	logger := jsonlog.New(os.Stdout, jsonlog.LevelInfo)
diff --git a/cmd/api/middleware.go b/cmd/api/middleware.go
index 4d8acba..68b2f97 100644
--- a/cmd/api/middleware.go
+++ b/cmd/api/middleware.go
@@ -170,3 +170,22 @@ func (app *application) requirePermissions(code string, next http.HandlerFunc) h
 	}
 	return app.requireActivatedUser(fn)
 }
+
+func (app *application) enableCORS(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Vary", "Origin")
+
+		origin := r.Header.Get("Origin")
+
+		if origin != "" {
+			for i := range app.config.cors.trustedOrigins {
+				if origin == app.config.cors.trustedOrigins[i] {
+					w.Header().Set("Access-Control-Allow-Origin", origin)
+					break
+				}
+			}
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/cmd/api/routes.go b/cmd/api/routes.go
index 616dd2c..1a41b09 100644
--- a/cmd/api/routes.go
+++ b/cmd/api/routes.go
@@ -25,5 +25,5 @@ func (app *application) routes() http.Handler {
 
 	router.HandlerFunc(http.MethodPost, "/v1/tokens/authentication", app.createAuthenticationTokenHandler)
 
-	return app.recoverPanic(app.rateLimit(app.authenticate(router)))
+	return app.recoverPanic(app.enableCORS(app.rateLimit(app.authenticate(router))))
 }
diff --git a/cmd/examples/cors/simple/main.go b/cmd/examples/cors/simple/main.go
new file mode 100644
index 0000000..06627d5
--- /dev/null
+++ b/cmd/examples/cors/simple/main.go
@@ -0,0 +1,45 @@
+package main
+
+import (
+	"flag"
+	"log"
+	"net/http"
+)
+
+const html = `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+	<meta charset="UTF-8">
+</head>
+<body>
+	<h1>Simple CORS</h1>
+	<div id="output"></div>
+	<script>
+		document.addEventListener('DOMContentLoaded', function() {
+			fetch("http://localhost:4000/v1/healthcheck").then(
+				function (response) {
+					response.text().then(function (text) {
+						document.getElementById("output").innerHTML = text;
+					});
+				},
+				function(err) {
+					document.getElementById("output").innerHTML = err;
+				}
+			);
+		});
+	</script>
+</body>
+</html>`
+
+func main() {
+	addr := flag.String("addr", ":9000", "Server address")
+	flag.Parse()
+
+	log.Printf("starting server on %s", *addr)
+
+	err := http.ListenAndServe(*addr, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(html))
+	}))
+	log.Fatal(err)
+}
