diff --git a/api/src/main.py b/api/src/main.py
index 3b03e17..46bf2d3 100644
--- a/api/src/main.py
+++ b/api/src/main.py
@@ -223,6 +223,17 @@ async def lifespan(app: FastAPI):
     allow_headers=["*"],
 )
 
+origins = ["http://localhost", "http://127.0.0.1:8000", "https://demo.honcho.dev"]
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=origins,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+
 if OPENTELEMTRY_ENABLED:
     FastAPIInstrumentor().instrument_app(app)
 
diff --git a/api/src/security.py b/api/src/security.py
index 1dfe6d9..f54758a 100644
--- a/api/src/security.py
+++ b/api/src/security.py
@@ -8,7 +8,9 @@
 USE_AUTH_SERVICE = os.getenv("USE_AUTH_SERVICE", "False").lower() == "true"
 AUTH_SERVICE_URL = os.getenv("AUTH_SERVICE_URL", "http://localhost:8001")
 
-security = HTTPBearer(auto_error=False)
+security = HTTPBearer(
+    auto_error=False,
+)
 
 
 async def auth(