diff --git a/lib/http_input.js b/lib/http_input.js
index e562f6c..1c5152b 100644
--- a/lib/http_input.js
+++ b/lib/http_input.js
@@ -34,6 +34,10 @@ function PhantInput(config) {
       return;
     }
 
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET,POST,DELETE');
+    res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With, Phant-Private-Key');
+
     var match = router.match(url.parse(req.url).pathname);
     match.fn(req, res, match);
 
@@ -291,6 +295,11 @@ app.setContentType = function(req, res) {
 
 app.route = function(action, req, res, match) {
 
+  if(req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    return res.end();
+  }
+
   var parsed = url.parse(req.url, true),
     form = formidable.IncomingForm(),
     input = this;
diff --git a/lib/http_output.js b/lib/http_output.js
index 1fa1021..2dee2eb 100644
--- a/lib/http_output.js
+++ b/lib/http_output.js
@@ -47,6 +47,9 @@ function PhantOutput(config) {
       return;
     }
 
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With');
+
     var match = router.match(url.parse(req.url).pathname);
     match.fn(req, res, match);
 
@@ -483,6 +486,11 @@ app.setContentType = function(req, res) {
 
 app.route = function(action, req, res, match) {
 
+  if(req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    return res.end();
+  }
+
   req.extension = match.params.ext;
   req.field = match.params.field;