diff --git a/backend/config/config.local.toml.example b/backend/config/config.local.toml.example
index adb45b8..8f95efc 100644
--- a/backend/config/config.local.toml.example
+++ b/backend/config/config.local.toml.example
@@ -7,6 +7,8 @@ port = 9300
 process_count = 1
 is_ssl = false
 is_test = true
+# CORS 허용 오리진(프론트). 비우면 [] (CORS 미적용). 예: 로컬 Vite = http://localhost:5173
+cors_origins = ["http://localhost:5173", "http://127.0.0.1:5173"]
 
 [LogConfig]
 print_console = true
diff --git a/backend/config/config_models.py b/backend/config/config_models.py
index d5af607..c338b82 100644
--- a/backend/config/config_models.py
+++ b/backend/config/config_models.py
@@ -7,6 +7,8 @@ class WebServerConfig(ConfigModel):
     process_count: int = 1
     is_ssl: bool = False
     is_test: bool = False
+    # CORS 허용 오리진(프론트). 비우면 CORS 미적용. 예: ["http://localhost:5173"]
+    cors_origins: list[str] = []
 
 
 class LogConfig(ConfigModel):
diff --git a/backend/router/router.py b/backend/router/router.py
index 15eec9c..6a8c54f 100644
--- a/backend/router/router.py
+++ b/backend/router/router.py
@@ -2,11 +2,13 @@ import time
 from contextlib import asynccontextmanager
 
 from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
 
 from common.database.db_session_manager import DB_SESSION_MNG
 from common.logger import LOG
 from common.utils.gtime import GTime
+from config.server_configs import web_server_config
 import router.v1.auth.account
 
 API_SERVER_START_TIME = GTime.UTCStr()
@@ -22,6 +24,17 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(title="Negosium Api Server", lifespan=lifespan)
 
+# CORS: config 의 cors_origins 가 있을 때만 적용(브라우저 프론트 호출 허용).
+# 명시적 오리진을 쓰므로 allow_credentials=True 가능(쿠키/Authorization 헤더 허용).
+if web_server_config.cors_origins:
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=web_server_config.cors_origins,
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
 # Accept-Encoding: gzip 요청에 대해 1000 bytes 이상 응답을 압축.
 app.add_middleware(GZipMiddleware, minimum_size=1000)