diff --git a/Cargo.toml b/Cargo.toml
index a9117b5..a531019 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,6 +20,7 @@ serde_json = "1.0"
 tokio = { version = "1.38", features = ["full"] }
 wait-timeout = "0.2"
 url = { version = "2.5", "features" = ["serde"] }
+tower-http = { version = "0.5", features = ["cors"] }
 
 [dev-dependencies]
 anyhow = "1.0"
diff --git a/src/api.rs b/src/api.rs
index 6c28cf3..672136b 100644
--- a/src/api.rs
+++ b/src/api.rs
@@ -6,10 +6,18 @@ use axum::{
 
 use crate::routes::{compile, create_gist, evaluate, static_css, static_html, static_js};
 use crate::GithubClient;
+use axum::http::HeaderValue;
 use std::net::SocketAddr;
+use tower_http::cors::CorsLayer;
 
 /// serve the api
 pub async fn serve(addr: SocketAddr, github_client: GithubClient) -> Result<()> {
+    let layer: CorsLayer = CorsLayer::new().allow_origin(
+        "https://tutorial.ponylang.io"
+            .parse::<HeaderValue>()
+            .unwrap(),
+    );
+
     let static_routes = Router::new()
         .route(
             "/web.css",
@@ -24,11 +32,12 @@ pub async fn serve(addr: SocketAddr, github_client: GithubClient) -> Result<()>
             get(|| async { static_js(include_bytes!("../static/mode-pony.js")) }),
         );
     let router = Router::new()
+        .route("/evaluate.json", post(evaluate))
+        .layer(layer) // applies to every route() call before on `router`
         .route(
             "/",
             get(|| async { static_html(include_bytes!("../static/web.html")) }),
         )
-        .route("/evaluate.json", post(evaluate))
         .route("/compile.json", post(compile))
         .route("/gist.json", post(create_gist))
         .with_state(github_client)