diff --git a/.env.example b/.env.example
index 247eec6..2f39949 100644
--- a/.env.example
+++ b/.env.example
@@ -16,3 +16,5 @@ R2_ACCESS_KEY_ID=XXX        # Any S3 compatible access key
 R2_SECRET_ACCESS_KEY=XXX    # Any S3 compatible secret access key
 R2_BUCKET=XXX               # Any S3 compatible bucket
 R2_CDN_URL=XXX              # Any S3 compatible CDN URL
+
+CORS_ORIGINS=https://app.jetkvm.com,http://localhost:5173 # Allowed CORS Origins, split by comma
\ No newline at end of file
diff --git a/src/index.ts b/src/index.ts
index db2cce1..e8631be 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -36,6 +36,8 @@ declare global {
       R2_SECRET_ACCESS_KEY: string;
       R2_BUCKET: string;
       R2_CDN_URL: string;
+
+      CORS_ORIGINS: string;
     }
   }
 }
@@ -48,7 +50,9 @@ app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 app.use(
   cors({
-    origin: ["https://app.jetkvm.com", "http://localhost:5173"],
+    origin: process.env.CORS_ORIGINS?.split(",") || [
+      "https://app.jetkvm.com", "http://localhost:5173"
+    ],
     credentials: true,
   }),
 );