diff --git a/api.php b/api.php
index 8007dd7..022b955 100644
--- a/api.php
+++ b/api.php
@@ -6,6 +6,20 @@ require_once __DIR__ . '/../common/ha.php';
 header('Content-Type: application/json; charset=utf-8');
 header('Cache-Control: no-store');
 
+$origin = (string)($_SERVER['HTTP_ORIGIN'] ?? '');
+if (preg_match('#^https://([a-z0-9-]+\.)?chaegeon\.com$#i', $origin) === 1) {
+    header('Access-Control-Allow-Origin: ' . $origin);
+    header('Access-Control-Allow-Credentials: true');
+    header('Access-Control-Allow-Headers: Content-Type, X-Requested-With');
+    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
+    header('Vary: Origin');
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
+    http_response_code(204);
+    exit;
+}
+
 $config = custom_config();
 
 function launcher_is_digit_password(string $password): bool