diff --git a/README.md b/README.md
index af4ee00..83f50c7 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,7 @@ EMAIL_SMTP_USER | string || email smtp username
 EMAIL_SMTP_PASSWORD | string || email smtp password
 EMAIL_FROM_ADDRESS | string || from address used in sending emails
 EMAIL_FROM_NAME | string || from name used in sending emails
+ENABLE_CORS | bool | false | enable CORS requests
 
 ### Contributing
 
diff --git a/api/api.go b/api/api.go
index eb3de06..9815404 100644
--- a/api/api.go
+++ b/api/api.go
@@ -22,7 +22,7 @@ import (
 )
 
 // New configures application resources and routes.
-func New() (*chi.Mux, error) {
+func New(enableCORS bool) (*chi.Mux, error) {
 	logger := logging.NewLogger()
 
 	db, err := database.DBConn()
@@ -67,7 +67,9 @@ func New() (*chi.Mux, error) {
 	r.Use(render.SetContentType(render.ContentTypeJSON))
 
 	// use CORS middleware if client is not served by this api, e.g. from other domain or CDN
-	// r.Use(corsConfig().Handler)
+	if enableCORS {
+		r.Use(corsConfig().Handler)
+	}
 
 	r.Mount("/auth", authResource.Router())
 	r.Group(func(r chi.Router) {
diff --git a/api/server.go b/api/server.go
index 93348bf..7b8965d 100644
--- a/api/server.go
+++ b/api/server.go
@@ -19,7 +19,7 @@ type Server struct {
 // NewServer creates and configures an APIServer serving all application routes.
 func NewServer() (*Server, error) {
 	log.Println("configuring server...")
-	api, err := New()
+	api, err := New(viper.GetBool("enable_cors"))
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/gendoc.go b/cmd/gendoc.go
index 07e47df..9324a83 100644
--- a/cmd/gendoc.go
+++ b/cmd/gendoc.go
@@ -47,7 +47,7 @@ func init() {
 }
 
 func genRoutesDoc() {
-	api, _ := api.New()
+	api, _ := api.New(false)
 	fmt.Print("generating routes markdown file: ")
 	md := docgen.MarkdownRoutesDoc(api, docgen.MarkdownOpts{
 		ProjectPath: "github.com/dhax/go-base",