diff --git a/.env.example b/.env.example
index cb62c8d9..2d6c1fe1 100644
--- a/.env.example
+++ b/.env.example
@@ -6,5 +6,7 @@ NEO4J_URI_BOLT=bolt://neo4j:7687
 NEO4J_USERNAME=neo4j
 NEO4J_PASSWORD=password
 VITE_API_URL=http://127.0.0.1:5001
+# Comma-separated CORS allowed origins. Defaults to http://localhost:5173 (Vite dev) when unset.
+ALLOWED_ORIGINS=http://localhost:5173
 DATABASE_URL=postgresql://flowsint:flowsint@localhost:5433/flowsint
 REDIS_URL=redis://redis:6379/0
diff --git a/flowsint-api/app/main.py b/flowsint-api/app/main.py
index 60c99215..e45875fe 100644
--- a/flowsint-api/app/main.py
+++ b/flowsint-api/app/main.py
@@ -1,3 +1,5 @@
+import os
+
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
@@ -16,8 +18,12 @@ from app.api.routes import types
 from app.api.routes import custom_types
 from app.api.routes import enricher_templates
 
+# Comma-separated list of allowed origins, e.g. "https://app.example.com,https://staging.example.com"
+# Falls back to localhost dev origin when unset. Never use "*" with allow_credentials=True.
 origins = [
-    "*",
+    o.strip()
+    for o in os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
+    if o.strip()
 ]