diff --git a/lib/http/base.js b/lib/http/base.js
index fb778389..1087aa7b 100644
--- a/lib/http/base.js
+++ b/lib/http/base.js
@@ -173,6 +173,7 @@ HTTPBase.prototype.cors = function cors() {
     res.setHeader(
       'Access-Control-Allow-Methods',
       'GET,HEAD,PUT,PATCH,POST,DELETE');
+    res.setHeader('Access-Control-Allow-Headers', 'Authorization');
 
     if (req.method === 'OPTIONS') {
       res.setStatus(200);