diff --git a/lib/cartodb/api/middlewares/cors.js b/lib/cartodb/api/middlewares/cors.js
index 34b06bf5..87e41dc7 100644
--- a/lib/cartodb/api/middlewares/cors.js
+++ b/lib/cartodb/api/middlewares/cors.js
@@ -5,7 +5,8 @@ module.exports = function cors () {
         const headers = [
             'X-Requested-With',
             'X-Prototype-Version',
-            'X-CSRF-Token'
+            'X-CSRF-Token',
+            'Authorization'
         ];
 
         if (req.method === 'OPTIONS') {
diff --git a/test/acceptance/ported/attributes.js b/test/acceptance/ported/attributes.js
index c5b97f5c..6f899c64 100644
--- a/test/acceptance/ported/attributes.js
+++ b/test/acceptance/ported/attributes.js
@@ -36,7 +36,7 @@ describe('attributes', function() {
     function checkCORSHeaders(res) {
         assert.equal(
             res.headers['access-control-allow-headers'],
-            'X-Requested-With, X-Prototype-Version, X-CSRF-Token'
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
         );
         assert.equal(res.headers['access-control-allow-origin'], '*');
     }
diff --git a/test/acceptance/ported/multilayer.js b/test/acceptance/ported/multilayer.js
index 5dd7ebbb..d7a0b0c7 100644
--- a/test/acceptance/ported/multilayer.js
+++ b/test/acceptance/ported/multilayer.js
@@ -25,8 +25,11 @@ describe('multilayer', function() {
     var IMAGE_EQUALS_TOLERANCE_PER_MIL = 20;
 
     function checkCORSHeaders(res) {
-      assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
-      assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(
+            res.headers['access-control-allow-headers'],
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
+        );
+        assert.equal(res.headers['access-control-allow-origin'], '*');
     }
 
     // See https://github.com/Vizzuality/Windshaft/issues/70
@@ -1027,7 +1030,8 @@ describe('multilayer', function() {
     //
     ////////////////////////////////////////////////////////////////////
 
-    it("get'ing options on layergroup should return CORS headers",  function(done){
+    it("geting options on layergroup should return CORS headers",  function(done){
+        const allowHeaders = 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization, Content-Type';
         assert.response(server, {
             url: '/database/windshaft_test/layergroup',
             method: 'OPTIONS'
@@ -1035,7 +1039,7 @@ describe('multilayer', function() {
             status: 200,
             // TODO: use checkCORSHeaders() function
             headers: {
-              'Access-Control-Allow-Headers': 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Content-Type',
+              'Access-Control-Allow-Headers': allowHeaders,
               'Access-Control-Allow-Origin': '*'
             }
         }, function() { done(); });
diff --git a/test/acceptance/ported/raster.js b/test/acceptance/ported/raster.js
index 04cf020a..58a6b2bf 100644
--- a/test/acceptance/ported/raster.js
+++ b/test/acceptance/ported/raster.js
@@ -18,8 +18,11 @@ describe('raster', function() {
     });
 
     function checkCORSHeaders(res) {
-      assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
-      assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(
+            res.headers['access-control-allow-headers'],
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
+        );
+        assert.equal(res.headers['access-control-allow-origin'], '*');
     }
 
     var IMAGE_EQUALS_TOLERANCE_PER_MIL = 2;
diff --git a/test/acceptance/ported/torque.js b/test/acceptance/ported/torque.js
index d5fd73be..82f3fda1 100644
--- a/test/acceptance/ported/torque.js
+++ b/test/acceptance/ported/torque.js
@@ -28,8 +28,11 @@ describe('torque', function() {
     });
 
     function checkCORSHeaders(res) {
-      assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
-      assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(
+            res.headers['access-control-allow-headers'],
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
+        );
+        assert.equal(res.headers['access-control-allow-origin'], '*');
     }
 
     it("missing required property from torque layer", function(done) {
diff --git a/test/acceptance/templates.js b/test/acceptance/templates.js
index 46e5aae6..e8038347 100644
--- a/test/acceptance/templates.js
+++ b/test/acceptance/templates.js
@@ -307,16 +307,17 @@ describe('template_api', function() {
           assert.response(server, post_request, {}, function(res) { next(null, res); });
         },
         function testCORS() {
-          assert.response(server, {
-              url: '/api/v1/map/named/acceptance1',
-              method: 'OPTIONS'
-          },{
-              status: 200,
-              headers: {
-                'Access-Control-Allow-Headers': 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Content-Type',
-                'Access-Control-Allow-Origin': '*'
-              }
-          }, function() { done(); });
+            const allowHeaders = 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization, Content-Type';
+            assert.response(server, {
+                url: '/api/v1/map/named/acceptance1',
+                method: 'OPTIONS'
+            },{
+                status: 200,
+                headers: {
+                    'Access-Control-Allow-Headers': allowHeaders,
+                    'Access-Control-Allow-Origin': '*'
+                }
+            }, function() { done(); });
       });
     });