diff --git a/README.md b/README.md
index b67c4f4..e2f7a1a 100644
--- a/README.md
+++ b/README.md
@@ -155,7 +155,7 @@ The application uses Keycloak for authentication. Configure your Keycloak server
 The application uses MongoDB. Ensure your MongoDB instance is running and accessible at the configured `DB_LINK`.
 
 ### CORS Configuration
-The application is configured to allow requests only from the specified `APP_URL_CLIENT`. Update this in your environment configuration.
+Allowed request origins are configured via `server.corsOrigins` in `config.json`. When omitted, the API falls back to `app.urlClient` and `app.urlElectronClient`.
 
 ## 🚀 Deployment
 
diff --git a/config.json b/config.json
index be8d3f6..505a01b 100644
--- a/config.json
+++ b/config.json
@@ -2,7 +2,14 @@
   "development": {
     "server": {
       "port": 8787,
-      "logLevel": "trace"
+      "logLevel": "trace",
+      "corsOrigins": [
+        "https://web.farmcontrol.app",
+        "https://dev.tombutcher.work",
+        "http://localhost:5173",
+        "http://localhost:3000",
+        "http://localhost:5780"
+      ]
     },
     "auth": {
       "enabled": true,
@@ -124,7 +131,8 @@
   "production": {
     "server": {
       "port": 8080,
-      "logLevel": "info"
+      "logLevel": "info",
+      "corsOrigins": ["https://web.farmcontrol.app", "views://mainview"]
     },
     "auth": {
       "enabled": true,
diff --git a/src/index.js b/src/index.js
index 946b59c..38e4437 100644
--- a/src/index.js
+++ b/src/index.js
@@ -81,14 +81,15 @@ logger.level = config.server.logLevel;
 
 app.use(log4js.connectLogger(logger, { level: 'trace' }));
 
-const whitelist = [config.app.urlClient, config.app.urlElectronClient];
+const allowedOrigins =
+  config.server.corsOrigins ||
+  [config.app.urlClient, config.app.urlElectronClient].filter(Boolean);
 const corsOptions = {
   origin: function (origin, callback) {
-    if (!origin || whitelist.indexOf(origin) !== -1) {
-      callback(null, true);
-    } else {
-      callback(new Error('Not allowed by CORS'));
-    }
+    if (!origin) return callback(null, true);
+    if (allowedOrigins.includes('*')) return callback(null, true);
+    if (allowedOrigins.includes(origin)) return callback(null, true);
+    callback(new Error('Not allowed by CORS'));
   },
   credentials: true,
 };