diff --git a/api/main.py b/api/main.py
index 76c1a15..12d81fa 100644
--- a/api/main.py
+++ b/api/main.py
@@ -46,6 +46,11 @@ app = FastAPI(
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["https://ai.yokogawa.tech"],
+    # The UI sends credentials: "include" so the browser attaches the Authelia
+    # session cookie. Without this the preflight fails and NO cross-origin call
+    # succeeds - the browser refuses a credentialed request unless the response
+    # says Access-Control-Allow-Credentials: true.
+    allow_credentials=True,
     allow_methods=["GET", "POST"],
     allow_headers=["Content-Type"],
 )