diff --git a/go.mod b/go.mod
index c8b1d6c..db78a6b 100644
--- a/go.mod
+++ b/go.mod
@@ -22,6 +22,11 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
 )
 
+require (
+	connectrpc.com/cors v0.1.0 // indirect
+	github.com/rs/cors v1.11.1 // indirect
+)
+
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect
 	buf.build/go/protovalidate v1.2.0 // indirect
diff --git a/go.sum b/go.sum
index f1942a4..e253474 100644
--- a/go.sum
+++ b/go.sum
@@ -10,6 +10,8 @@ cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
 connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
+connectrpc.com/cors v0.1.0 h1:f3gTXJyDZPrDIZCQ567jxfD9PAIpopHiRDnJRt3QuOQ=
+connectrpc.com/cors v0.1.0/go.mod h1:v8SJZCPfHtGH1zsm+Ttajpozd4cYIUryl4dFB6QEpfg=
 connectrpc.com/grpcreflect v1.3.0 h1:Y4V+ACf8/vOb1XOc251Qun7jMB75gCUNw6llvB9csXc=
 connectrpc.com/grpcreflect v1.3.0/go.mod h1:nfloOtCS8VUQOQ1+GTdFzVg2CJo4ZGaat8JIovCtDYs=
 connectrpc.com/validate v0.6.0 h1:DcrgDKt2ZScrUs/d/mh9itD2yeEa0UbBBa+i0mwzx+4=
@@ -46,6 +48,8 @@ github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
 github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
+github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/stoewer/go-strcase v1.3.1 h1:iS0MdW+kVTxgMoE1LAZyMiYJFKlOzLooE4MxjirtkAs=
 github.com/stoewer/go-strcase v1.3.1/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
diff --git a/internal/config/config.go b/internal/config/config.go
index ff52f65..049e5dc 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -10,6 +10,7 @@ type Config struct {
 	LISTEN_ON       string   `json:"listen_on"`
 	TRUSTED_PROXIES []string `json:"trusted_proxies"`
 	OTLP_ENDPOINT   string   `json:"otlp_endpoint"`
+	ALLOWED_ORIGINS []string `json:"allowed_origins"`
 }
 
 func Read() *Config {
diff --git a/main.go b/main.go
index 3623612..6705304 100644
--- a/main.go
+++ b/main.go
@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"connectrpc.com/connect"
+	connectcors "connectrpc.com/cors"
 	"connectrpc.com/grpcreflect"
 	"connectrpc.com/validate"
 	"git.kocoder.xyz/vt/shortener/internal/config"
@@ -15,6 +16,7 @@ import (
 	"git.kocoder.xyz/vt/shortener/internal/service"
 	"git.kocoder.xyz/vt/shortener/internal/telemetry"
 	_ "github.com/lib/pq"
+	"github.com/rs/cors"
 	"github.com/uptrace/opentelemetry-go-extra/otelsql"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.opentelemetry.io/otel/attribute"
@@ -66,8 +68,17 @@ func main() {
 
 	mux.Handle("/", srv)
 
+	c := cors.New(cors.Options{
+		AllowedOrigins: conf.ALLOWED_ORIGINS,
+		AllowedMethods: connectcors.AllowedMethods(),
+		AllowedHeaders: connectcors.AllowedHeaders(),
+		ExposedHeaders: connectcors.ExposedHeaders(),
+		MaxAge:         7200,
+	})
+	corsMux := c.Handler(mux)
+
 	// Wrap the server with OpenTelemetry HTTP handler for tracing & metrics
-	instrumentedHandler := otelhttp.NewHandler(mux, "shortener-server2")
+	instrumentedHandler := otelhttp.NewHandler(corsMux, "shortener-server2")
 
 	p := new(http.Protocols)
 	p.SetHTTP1(true)