diff --git a/src/crud.test.js b/src/crud.test.js
index 0856451..362f65f 100644
--- a/src/crud.test.js
+++ b/src/crud.test.js
@@ -225,7 +225,7 @@ test('crud#list handler with order', async (t) => {
 
   t.deepEqual(
     findAllArgs.order,
-    [request.query.order],
+    [[request.query.order]],
     'queries with the order as an array b/c that\'s what sequelize wants'
   );
 });
diff --git a/src/get-config-for-method.js b/src/get-config-for-method.js
index a87a43e..d6bc661 100644
--- a/src/get-config-for-method.js
+++ b/src/get-config-for-method.js
@@ -144,7 +144,7 @@ export default ({
       .keys({
         limit: joi.number().min(0).integer(),
         offset: joi.number().min(0).integer(),
-        order: joi.array(),
+        order: [joi.array(), joi.string()],
       }),
       get(methodConfig, 'validate.query')
     );
diff --git a/src/utils.js b/src/utils.js
index bc19051..dae90c0 100644
--- a/src/utils.js
+++ b/src/utils.js
@@ -70,7 +70,7 @@ export const parseOrder = (request) => {
 
   // transform to an array so sequelize will escape the input for us and
   // maintain security. See http://docs.sequelizejs.com/en/latest/docs/querying/#ordering
-  if (isString(order)) return order.split(' ');
+  if (isString(order)) return [order.split(' ')];
 
   for (const key of Object.keys(order)) {
     try {
@@ -80,7 +80,7 @@ export const parseOrder = (request) => {
     }
   }
 
-  return order;
+  return [order];
 };
 
 export const getMethod = (model, association, plural = true, method = 'get') => {
diff --git a/src/utils.test.js b/src/utils.test.js
index 43eb29e..bd91198 100644
--- a/src/utils.test.js
+++ b/src/utils.test.js
@@ -57,7 +57,7 @@ test('parseOrder returns order when a string', (t) => {
 
   t.deepEqual(
     parseOrder(request)
-    , [order]
+    , [[order]]
   );
 });
 
@@ -69,7 +69,7 @@ test('parseOrder returns order when json', (t) => {
 
   t.deepEqual(
     parseOrder(request)
-    , order
+    , [order]
   );
 });