diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 6f077f832..2df9dafd6 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -27,7 +27,9 @@ class AuthServiceProvider extends ServiceProvider
         $this->registerPolicies();
 
         if(config('pixelfed.oauth_enabled')) {
-            Passport::routes();
+            Route::group(['middleware' => 'cors'], function() {
+                Passport::routes();
+            });
             Passport::tokensExpireIn(now()->addDays(15));
             Passport::refreshTokensExpireIn(now()->addDays(30));
             Passport::enableImplicitGrant();
diff --git a/composer.json b/composer.json
index 93aad5904..81f06ddd7 100644
--- a/composer.json
+++ b/composer.json
@@ -13,6 +13,7 @@
         "ext-json": "*",
         "ext-mbstring": "*",
         "ext-openssl": "*",
+        "barryvdh/laravel-cors": "0.11.4",
         "beyondcode/laravel-self-diagnosis": "^1.0.2",
         "doctrine/dbal": "^2.7",
         "fideloper/proxy": "^4.0",