diff --git a/.env.docker.sample b/.env.docker.sample
index af92142..4bcc074 100644
--- a/.env.docker.sample
+++ b/.env.docker.sample
@@ -9,3 +9,4 @@ TWILIO_AUTH_SID=9M438C93R943U4329MCU43C34U
 TWILIO_SERVICE_SID=9M4J3X8439U398NUVT3342MC349C348T
 TWILIO_AUTH_TOKEN="f4a1f2b0b79ea3735078c2d8ee9684e1"
 TWILIO_PHONE_NUMBER=+10123456789
+ALLOWED_ORIGINS="http://textsender.com"
diff --git a/.env.local.sample b/.env.local.sample
index 5c205fa..e47c1f5 100644
--- a/.env.local.sample
+++ b/.env.local.sample
@@ -9,3 +9,4 @@ TWILIO_AUTH_SID=9M438C93R943U4329MCU43C34U
 TWILIO_SERVICE_SID=9M4J3X8439U398NUVT3342MC349C348T
 TWILIO_AUTH_TOKEN="f4a1f2b0b79ea3735078c2d8ee9684e1"
 TWILIO_PHONE_NUMBER=+10123456789
+ALLOWED_ORIGINS="http://textsender.com"
diff --git a/.gitea/workflows/workflow.yaml b/.gitea/workflows/workflow.yaml
index 1c6034c..dc80dac 100644
--- a/.gitea/workflows/workflow.yaml
+++ b/.gitea/workflows/workflow.yaml
@@ -107,6 +107,7 @@ jobs:
           echo "TWILIO_SERVICE_SID=9M4J3X8439U398NUVT3342MC349C348T" >> .env
           echo "TWILIO_AUTH_TOKEN=f4a1f2b0b79ea3735078c2d8ee9684e1" >> .env
           echo "TWILIO_PHONE_NUMBER=10123456789" >> .env
+          echo "ALLOWED_ORIGINS=http://localhost:5173" >> .env
 
           echo "Initializing config"
           mkdir -p ~/.ssh
diff --git a/cmd/api/main.go b/cmd/api/main.go
index fcc11a9..6a7e0a6 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -95,7 +95,7 @@ func main() {
 
 	// Configure CORS
 	router.Use(cors.Handler(cors.Options{
-		AllowedOrigins:   []string{fmt.Sprintf("http://localhost:%s", config.PORT), "http://localhost:5173", "https://textsender.com"},
+		AllowedOrigins:   cfg.AllowedOrigins,
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link", "X-Total-Count"},
diff --git a/internal/config/config.go b/internal/config/config.go
index aabedb2..9efeea0 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"strconv"
+	"strings"
 
 	"git.kundeng.us/phoenix/textsender-models/tx0/config"
 	"github.com/joho/godotenv"
@@ -18,6 +19,7 @@ type Config struct {
 	ResetDB      bool
 	JWTSecret    string `env:"JWT_SECRET" required:"true"`
 	TwilioConfig *config.TwiloConfig
+	AllowedOrigins []string
 }
 
 type ConnectionInfo struct {
@@ -68,11 +70,13 @@ func Load() (*Config, *config.TwiloConfig, error) {
 	if cfg, err := TwilioConfig(); err != nil {
 		return nil, nil, err
 	} else {
+		allowedOrigins := unpackAllowedOrigins()
 		return &Config{
 			DBConnString: dbConnString,
 			ServerPort:   *port,
 			ResetDB:      *resetDb,
 			JWTSecret:    os.Getenv("JWT_SECRET"),
+			AllowedOrigins: allowedOrigins,
 		}, cfg, nil
 	}
 }
@@ -128,6 +132,12 @@ func UnpackDBConnString() (connInfo ConnectionInfo) {
 	return
 }
 
+func unpackAllowedOrigins() []string {
+	allowedOriginsRaw := os.Getenv("ALLOWED_ORIGINS")
+	allowedOriginsSplit := strings.Split(allowedOriginsRaw, ",")
+	return allowedOriginsSplit
+}
+
 func TwilioConfig() (*config.TwiloConfig, error) {
 	authSid := os.Getenv("TWILIO_AUTH_SID")
 	serviceSid := os.Getenv("TWILIO_SERVICE_SID")