diff --git a/README.md b/README.md
index 6b89499..1cc655e 100644
--- a/README.md
+++ b/README.md
@@ -7,11 +7,18 @@ Persistence cloud API to store locations of objects in Unity 3D space.
 First, create a `.env` file in the root of the directory with the following values:
 
 ```bash
+ALLOWED_ORIGINS=http://localhost:5173,https://localhost:5173,http://localhost,https://localhost
+
 POSTGRES_HOST=postgres
 POSTGRES_USER=tmdbuser
 POSTGRES_PASSWORD=bigland
 POSTGRES_DATABASE=terramajor
 POSTGRES_SSL=disable
+
+COSMOS_DB_HOST=cosmos
+COSMOS_DB_PORT=8081
+COSMOS_DB_PRIMARY_KEY=xxx
+COSMOS_DB_NAME=terramajor
 ```
 
 Next, run the local database:
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 851a74b..ac9dfc0 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,4 +1,4 @@
-version: "3.9" 
+
 
 x-db-variables: &db-variables
   POSTGRES_HOST: $POSTGRES_HOST
@@ -11,6 +11,10 @@ x-db-variables: &db-variables
   COSMOS_DB_PRIMARY_KEY: $COSMOS_DB_PRIMARY_KEY
   COSMOS_DB_NAME: $COSMOS_DB_NAME
 
+x-env-variables: &env-variables
+  <<: *db-variables
+  ALLOWED_ORIGINS: $ALLOWED_ORIGINS
+
 networks:
   local:
 
@@ -60,7 +64,7 @@ services:
       context: .
       dockerfile: ./Dockerfile.dev
     environment:
-      <<: *db-variables
+      <<: *env-variables
       PORT: 8000
     networks:
       local:
@@ -74,7 +78,7 @@ services:
       context: .
       dockerfile: ./Dockerfile
     environment:
-      <<: *db-variables
+      <<: *env-variables
       PORT: 80
     networks:
       local:
diff --git a/main.go b/main.go
index 86b9501..da558a8 100644
--- a/main.go
+++ b/main.go
@@ -3,6 +3,8 @@ package main
 import (
 	"fmt"
 	"net/http"
+	"os"
+	"strings"
 
 	"github.com/gorilla/handlers"
 
@@ -38,6 +40,21 @@ func main() {
 	http.ListenAndServe(":"+PORT, nil)
 }
 
+// Create a CORS handler with allowed origins
+func createCorsHandler() func(http.Handler) http.Handler {
+	orginsArray := os.Getenv("ALLOWED_ORIGINS")
+	fmt.Println("Allowed origins: " + orginsArray)
+	allowedOrigins := strings.Split(orginsArray, ",")
+	allowedMethods := []string{"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"}
+	allheaders := []string{"X-Requested-With", "Content-Type", "Authorization"}
+
+	return handlers.CORS(
+		handlers.AllowedMethods(allowedMethods),
+		handlers.AllowedOrigins(allowedOrigins),
+		handlers.AllowedHeaders(allheaders),
+	)
+}
+
 func registerMuxHandlers(app *core.App) http.Handler {
 	// Auth
 	app.Router.HandleFunc("/login", accounts.Login(app)).Methods("POST")
@@ -75,9 +92,7 @@ func registerMuxHandlers(app *core.App) http.Handler {
 
 	app.Router.HandleFunc("/sandboxes/{sandboxId}/chunks", terrains.GetChunksBySandboxId(app)).Methods("GET")
 
-	corsObj := handlers.CORS(handlers.AllowedMethods([]string{"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"}),
-		handlers.AllowedOrigins([]string{"*"}),
-		handlers.AllowedHeaders([]string{"X-Requested-With", "Content-Type", "Authorization"}))
+	corsHandler := createCorsHandler()
 
-	return corsObj(app.Router)
+	return corsHandler(app.Router)
 }