diff --git a/.env.example b/.env.example
index 43cc55e..aebf1f2 100644
--- a/.env.example
+++ b/.env.example
@@ -51,4 +51,8 @@ ENABLE_SWAGGER_ENDPOINT=TRUE
 # OPTIONAL, BASE PATH FOR MOUNTING ROUTES (e.g., /api/v1/whatsapp)
 BASE_PATH=
 # OPTIONAL, ENABLE WHEN BEHIND REVERSE PROXY/LOAD BALANCER
-TRUST_PROXY=FALSE
\ No newline at end of file
+TRUST_PROXY=FALSE
+
+## CORS ##
+# OPTIONAL, CORS ALLOWED ORIGINS (comma separated), DEFAULT ALLOWS ALL
+# ALLOWED_ORIGINS=http://localhost:3000,http://example.com
\ No newline at end of file
diff --git a/package-lock.json b/package-lock.json
index 3bf92fc..44dd2ac 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,6 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "axios": "^1.13.2",
+        "cors": "^2.8.5",
         "dotenv": "^16.6.1",
         "express": "^4.22.1",
         "express-rate-limit": "^7.5.1",
@@ -31,7 +32,7 @@
         "swagger-autogen": "^2.23.7"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
     "node_modules/@ampproject/remapping": {
@@ -2601,6 +2602,19 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/cors": {
+      "version": "2.8.5",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.5.tgz",
+      "integrity": "sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==",
+      "license": "MIT",
+      "dependencies": {
+        "object-assign": "^4",
+        "vary": "^1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/cosmiconfig": {
       "version": "9.0.0",
       "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-9.0.0.tgz",
@@ -6411,6 +6425,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/object-inspect": {
       "version": "1.13.3",
       "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.3.tgz",
diff --git a/package.json b/package.json
index 83ca610..535fff6 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "axios": "^1.13.2",
+    "cors": "^2.8.5",
     "dotenv": "^16.6.1",
     "express": "^4.22.1",
     "express-rate-limit": "^7.5.1",
diff --git a/src/app.js b/src/app.js
index 7a0dbdb..52e4b84 100644
--- a/src/app.js
+++ b/src/app.js
@@ -1,5 +1,6 @@
 require('./routes')
 const express = require('express')
+const cors = require('cors')
 const { routes } = require('./routes')
 const { maxAttachmentSize, basePath, trustProxy } = require('./config')
 
@@ -16,6 +17,11 @@ if (trustProxy) {
 app.use(express.json({ limit: maxAttachmentSize + 1000000 }))
 app.use(express.urlencoded({ limit: maxAttachmentSize + 1000000, extended: true }))
 
+app.use(cors({
+  origin: process.env.ALLOWED_ORIGINS?.split(',') || '*',
+  credentials: true
+}))
+
 // Mount routes with configurable base path
 app.use(basePath, routes)