diff --git a/apps/api/src/server.js b/apps/api/src/server.js
index 3f3595f..938ba74 100644
--- a/apps/api/src/server.js
+++ b/apps/api/src/server.js
@@ -20,7 +20,9 @@ await fastify.register(helmet, {
 // CORS middleware
 fastify.addHook('onRequest', async (request, reply) => {
   const origin = request.headers.origin;
-  const allowedOrigins = ['https://metalfrom.eu', 'https://www.metalfrom.eu'];
+  const allowedOrigins = process.env.CORS_ORIGINS
+    ? process.env.CORS_ORIGINS.split(',').map(s => s.trim())
+    : ['https://metalfrom.eu', 'https://www.metalfrom.eu'];
   
   if (allowedOrigins.includes(origin)) {
     reply.header('Access-Control-Allow-Origin', origin);