diff --git a/api.go b/api.go
index 65cb0dd..c673870 100644
--- a/api.go
+++ b/api.go
@@ -56,11 +56,14 @@ func (a apiServer) Register(r *mux.Router) {
 }
 
 func (a apiServer) handleCreate(res http.ResponseWriter, r *http.Request) {
-	res.Header().Set("Access-Control-Allow-Origin", "*")
-	res.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
-	if r.Method == http.MethodOptions {
-		res.WriteHeader(http.StatusNoContent)
-		return
+	if cust.AddCORSHeaders {
+		res.Header().Set("Access-Control-Allow-Origin", "*")
+		res.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
+		if r.Method == http.MethodOptions {
+			res.WriteHeader(http.StatusNoContent)
+			return
+		}
+
 	}
 
 	if cust.MaxSecretSize > 0 {
diff --git a/pkg/customization/customize.go b/pkg/customization/customize.go
index 8e4a20b..db2c0cf 100644
--- a/pkg/customization/customize.go
+++ b/pkg/customization/customize.go
@@ -41,6 +41,7 @@ type (
 		MetricsAllowedSubnets []string `json:"-" yaml:"metricsAllowedSubnets"`
 		OverlayFSPath         string   `json:"-" yaml:"overlayFSPath"`
 		UseFormalLanguage     bool     `json:"-" yaml:"useFormalLanguage"`
+		AddCORSHeaders        bool     `json:"-" yaml:"addCORSHeaders"`
 
 		FooterLinks []FooterLink `json:"footerLinks,omitempty" yaml:"footerLinks"`
 	}