diff --git a/backend/packages/app/src/windup_app/bootstrap/app.py b/backend/packages/app/src/windup_app/bootstrap/app.py
index 8d600137..542000cf 100644
--- a/backend/packages/app/src/windup_app/bootstrap/app.py
+++ b/backend/packages/app/src/windup_app/bootstrap/app.py
@@ -4,7 +4,10 @@
 是整个 web 服务的唯一装配点(composition root)。
 """
 
+import os
+
 from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
 
 from windup_app.web.api.agent import router as ai_router
 from windup_app.web.api.generation import router as generation_router
@@ -12,9 +15,24 @@
 from windup_app.web.api.workflow_run import router as workflow_run_router
 
 
+def _cors_origins() -> list[str]:
+    """开发阶段全放行；部署时用 ``WINDUP_CORS_ORIGINS``(逗号分隔)收窄。"""
+    raw = os.getenv("WINDUP_CORS_ORIGINS", "").strip()
+    return [o.strip() for o in raw.split(",") if o.strip()] or ["*"]
+
+
 def create_app() -> FastAPI:
     app = FastAPI(title="windup", version="0.1.0")
 
+    # 鉴权走 Authorization 头不走 cookie，故关掉 credentials —— 这样 "*" 才合法。
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=_cors_origins(),
+        allow_credentials=False,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
     # 业务路由
     app.include_router(media_router)
     app.include_router(generation_router)