diff --git a/ai-patient-onboarding/app/main.py b/ai-patient-onboarding/app/main.py
index ae303cd..44291bf 100644
--- a/ai-patient-onboarding/app/main.py
+++ b/ai-patient-onboarding/app/main.py
@@ -27,11 +27,24 @@ app = FastAPI(
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["*"],
-    allow_credentials=True,
+    allow_credentials=False,
     allow_methods=["*"],
     allow_headers=["*"],
 )
 
+
+@app.options("/{full_path:path}")
+async def options_preflight(full_path: str):
+    from fastapi import Response, status
+    return Response(
+        status_code=status.HTTP_204_NO_CONTENT,
+        headers={
+            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+            "Access-Control-Allow-Headers": "*",
+        },
+    )
+
 app.include_router(onboarding_router)
 app.include_router(voice_router)
 app.include_router(documents_router)