diff --git a/api/server/config.yml b/api/server/config.yml
index 42440297..e94ccb5d 100755
--- a/api/server/config.yml
+++ b/api/server/config.yml
@@ -16,7 +16,9 @@ api:
     CORS:
       max_age: 300
       allowed_origins:
-        - "*"
+        - "https://sendico.io"
+        - "https://app.sendico.io"
+        - "https://www.sendico.io"
       allowed_methods:
         - "GET"
         - "POST"