diff --git a/fusion/cors.sh b/fusion/cors.sh
new file mode 100755
index 0000000..a970420
--- /dev/null
+++ b/fusion/cors.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+URL="https://aus-design.sandbox.fusion.services.axway.com:4443/tokenize"
+ORIGIN="${1:-https://d3n89cj9w7ynf0.cloudfront.net}"
+h(){ grep -i '^access-control-allow-origin:' | tr -d '\r'; }
+echo "origin: $ORIGIN"
+PRE=$(curl -s -i -m 15 -X OPTIONS "$URL" -H "Origin: $ORIGIN" \
+      -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: content-type")
+AO_PRE=$(printf '%s' "$PRE" | h)
+echo "preflight: ${AO_PRE:-❌ MISSING allow-origin (browser blocks here)}"
+POST=$(curl -s -i -m 40 -X POST "$URL" -H "Origin: $ORIGIN" \
+       -H 'content-type: application/json' -d '{"query":"probe 王小明"}')
+echo "post:      $(printf '%s' "$POST" | head -1 | tr -d '\r')  ${$(printf '%s' "$POST" | h):-❌ MISSING}"
+[ -n "$AO_PRE" ] && printf '%s' "$POST" | h >/dev/null && echo "✅ READY — repoint the UI" || echo "⛔ NOT READY"