diff --git a/stellar-payment-platform/.env.example b/stellar-payment-platform/.env.example
index 23a2d9a..77c7d6b 100644
--- a/stellar-payment-platform/.env.example
+++ b/stellar-payment-platform/.env.example
@@ -45,3 +45,9 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/stellar_tags?schema=
 # --- Admin API Key -------------------------------------------------------------
 # Key used to authenticate with protected admin endpoints (e.g., blocking addresses)
 ADMIN_API_KEY="your-secure-admin-api-key-here"
+
+# --- CORS ------------------------------------------------------------------
+# Extra origins allowed to call the API, beyond the built-in localhost/vercel
+# defaults. Accepts a single origin or a comma-separated list.
+# CORS_ALLOWED_ORIGINS="https://example.com,https://staging.example.com"
+# VITE_API_BASE="https://api.yourdomain.com"
diff --git a/stellar-payment-platform/server.js b/stellar-payment-platform/server.js
index 0d67179..04328a8 100644
--- a/stellar-payment-platform/server.js
+++ b/stellar-payment-platform/server.js
@@ -81,11 +81,17 @@ app.set('query parser', 'simple');
 const PORT = process.env.PORT || 5000;
 const STELLAR_TAG_DOMAIN = process.env.STELLAR_TAG_DOMAIN;
 
+const envOrigins = process.env.CORS_ALLOWED_ORIGINS
+  ? process.env.CORS_ALLOWED_ORIGINS.split(',').map(o => o.trim())
+  : [];
+
 const allowedOrigins = [
   'http://localhost:5173',
   'http://localhost:3000',
   'https://stellar-tags.vercel.app',
   STELLAR_TAG_DOMAIN,
+  process.env.VITE_API_BASE,
+  ...envOrigins,
 ].filter(Boolean);
 
 const corsOptions = {
@@ -93,7 +99,7 @@ const corsOptions = {
     if (!origin || allowedOrigins.includes(origin)) {
       return callback(null, true);
     }
-    return callback(null, false);
+    return callback(new Error('Not allowed by CORS'));
   },
   methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
   allowedHeaders: ['Content-Type', 'Authorization'],
@@ -101,6 +107,8 @@ const corsOptions = {
   optionsSuccessStatus: 204,
 };
 
+app.use(cors(corsOptions));
+
 // Apply metrics middleware to track all HTTP requests
 app.use(metricsMiddleware);