diff --git a/lib/mvcfronk/mfBase/mfBaseApicontroller.php b/lib/mvcfronk/mfBase/mfBaseApicontroller.php
index 1b6c50c0d..1430d1867 100644
--- a/lib/mvcfronk/mfBase/mfBaseApicontroller.php
+++ b/lib/mvcfronk/mfBase/mfBaseApicontroller.php
@@ -47,6 +47,9 @@ class mfBaseApicontroller {
     // allow all origins
     if($this->http_method == "OPTIONS") {
       // dont execute route, OPTIONS only requires CORS headers
+      header("Access-Control-Allow-Methods: GET,POST,OPTIONS");
+      header("Access-Control-Allow-Headers: X-Api-Key");
+      
       if(preg_match('#^(https?)://(.+)(:\d+)?$#i', $this->headers['origin'], $m)) {
         $origin_proto = $m[1];
         $origin_hostname = $m[2];