diff --git a/geomagio/api/ws/app.py b/geomagio/api/ws/app.py
index 8d72e32611a4bc32b61ff595a46cdaa049183ef8..6f2c49e555bd6913befc73169dd22539089d56cb 100644
--- a/geomagio/api/ws/app.py
+++ b/geomagio/api/ws/app.py
@@ -34,11 +34,11 @@ app.include_router(observatories.router)
 @app.middleware("http")
 async def add_headers(request: Request, call_next):
     response = await call_next(request)
-    response.headers["Access-Control-Allow-Origin"] = "*"
-    response.headers["Access-Control-Allow-Methods"] = "*"
     response.headers[
         "Access-Control-Allow-Headers"
     ] = "accept, origin, authorization, content-type"
+    response.headers["Access-Control-Allow-Methods"] = "*"
+    response.headers["Access-Control-Allow-Origin"] = "*"
     response.headers["Cache-Control"] = "max-age=60"
     return response