diff --git a/app.js b/app.js
index 710429e..e40b594 100644
--- a/app.js
+++ b/app.js
@@ -93,6 +93,21 @@ const pool = new Pool({
   connectionString: process.env.DATABASE_URL,
 });
 
+// CORS für Hallenplaner-API
+const ALLOWED_ORIGINS = ['https://halle.tkdduisburg.de'];
+app.use('/api/layouts', (req, res, next) => {
+  const origin = req.headers.origin;
+  if (ALLOWED_ORIGINS.includes(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+  }
+  if (req.method === 'OPTIONS') {
+    return res.sendStatus(204);
+  }
+  next();
+});
+
 // Api für Hallenplaner
 app.get('/api/layouts', async (req, res) => {
   try {