diff --git a/core-backend/main.go b/core-backend/main.go
index 58d08d6..fc86e7c 100644
--- a/core-backend/main.go
+++ b/core-backend/main.go
@@ -49,8 +49,32 @@ type draftMessageRequest struct {
 	K             int      `json:"k"`
 }
 
+// corsMiddleware allows Flutter Web (and other local origins) to call the API.
+// Browsers treat http://localhost:5555 and http://127.0.0.1:8080 as different
+// origins, so Chrome signup fails without OPTIONS + Allow-Origin headers.
+func corsMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		origin := c.GetHeader("Origin")
+		if origin == "" {
+			origin = "*"
+		}
+		c.Header("Access-Control-Allow-Origin", origin)
+		c.Header("Vary", "Origin")
+		c.Header("Access-Control-Allow-Credentials", "true")
+		c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With")
+		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+		c.Header("Access-Control-Max-Age", "600")
+		if c.Request.Method == http.MethodOptions {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+		c.Next()
+	}
+}
+
 func setupRouter(db *gorm.DB, relay *ConnectionManager, ai *AIServiceClient) *gin.Engine {
 	r := gin.Default()
+	r.Use(corsMiddleware())
 
 	r.GET("/health", func(c *gin.Context) {
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})