diff --git a/api/.env.development b/api/.env.development
index 5f3dbcc..dc5e54f 100644
--- a/api/.env.development
+++ b/api/.env.development
@@ -4,9 +4,8 @@ SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhY
 STREAM_CHAT_API_KEY=t5vvvddteapa
 STREAM_CHAT_API_SECRET=zrr32sqenw3atpv9rnz2nhhyyncf7bunr7fmfqy9r7e69fcw978dhzevmhpxa2jj
 
-FRONTEND_URL=http://localhost:5173
-
 EMAIL_USER="baptiste@xtablo.com"
 EMAIL_KEY="jayf pzpj nrsv vtim"
 
 XTABLO_URL="https://app-staging.xtablo.com"
+CORS_ORIGIN="https://app-staging.xtablo.com"
\ No newline at end of file
diff --git a/api/.env.staging b/api/.env.staging
index a7f835c..dc5e54f 100644
--- a/api/.env.staging
+++ b/api/.env.staging
@@ -4,9 +4,8 @@ SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhY
 STREAM_CHAT_API_KEY=t5vvvddteapa
 STREAM_CHAT_API_SECRET=zrr32sqenw3atpv9rnz2nhhyyncf7bunr7fmfqy9r7e69fcw978dhzevmhpxa2jj
 
-FRONTEND_URL=https://app-staging.xtablo.com
-
 EMAIL_USER="baptiste@xtablo.com"
 EMAIL_KEY="jayf pzpj nrsv vtim"
 
-XTABLO_URL="https://app-staging.xtablo.com"
\ No newline at end of file
+XTABLO_URL="https://app-staging.xtablo.com"
+CORS_ORIGIN="https://app-staging.xtablo.com"
\ No newline at end of file
diff --git a/api/src/config.ts b/api/src/config.ts
index c0d57b4..00eb584 100644
--- a/api/src/config.ts
+++ b/api/src/config.ts
@@ -3,7 +3,6 @@ import dotenv from "dotenv";
 export interface AppConfig {
   NODE_ENV: "development" | "production" | "test" | "staging";
   PORT: number;
-  FRONTEND_URL: string;
   SUPABASE_URL: string;
   SUPABASE_SERVICE_ROLE_KEY: string;
   STREAM_CHAT_API_KEY: string;
@@ -35,7 +34,6 @@ function createConfig(): AppConfig {
   const baseConfig: AppConfig = {
     NODE_ENV,
     PORT: parseInt(process.env.PORT || "8080", 10),
-    FRONTEND_URL: process.env.FRONTEND_URL || "http://localhost:5173",
     SUPABASE_URL: validateEnvVar("SUPABASE_URL", process.env.SUPABASE_URL),
     SUPABASE_SERVICE_ROLE_KEY: validateEnvVar(
       "SUPABASE_SERVICE_ROLE_KEY",
@@ -51,38 +49,23 @@ function createConfig(): AppConfig {
     ),
     EMAIL_USER: validateEnvVar("EMAIL_USER", process.env.EMAIL_USER),
     EMAIL_KEY: validateEnvVar("EMAIL_KEY", process.env.EMAIL_KEY),
-    CORS_ORIGIN: [],
+    CORS_ORIGIN: [process.env.CORS_ORIGIN || "https://app.xtablo.com"],
     XTABLO_URL: process.env.XTABLO_URL || "https://app.xtablo.com",
     LOG_LEVEL: "info",
   };
 
   // Environment-specific configurations
   if (NODE_ENV === "development") {
-    baseConfig.CORS_ORIGIN = [
-      "http://localhost:5173",
-      "http://localhost:3000",
-      "http://127.0.0.1:5173",
-      "http://127.0.0.1:3000",
-    ];
     baseConfig.LOG_LEVEL = "debug";
-  } else if (NODE_ENV === "staging") {
-    baseConfig.CORS_ORIGIN = ["https://app-staging.xtablo.com"];
   } else if (NODE_ENV === "production") {
-    baseConfig.CORS_ORIGIN = [
-      baseConfig.FRONTEND_URL,
-      "https://app.xtablo.com",
-      "https://develop.xtablo-source.pages.dev",
-    ];
     baseConfig.LOG_LEVEL = "info";
   } else if (NODE_ENV === "test") {
-    baseConfig.CORS_ORIGIN = ["http://localhost:3000"];
     baseConfig.LOG_LEVEL = "warn";
   }
 
   // Log configuration info
   console.info(`Configuration loaded for ${NODE_ENV} environment:`);
   console.info(`- Port: ${baseConfig.PORT}`);
-  console.info(`- Frontend URL: ${baseConfig.FRONTEND_URL}`);
   console.info(`- CORS Origins: ${baseConfig.CORS_ORIGIN.join(", ")}`);
   console.info(`- Log Level: ${baseConfig.LOG_LEVEL}`);
   console.info(`- XTablo URL: ${baseConfig.XTABLO_URL}`);
diff --git a/api/src/index.ts b/api/src/index.ts
index 4f2b310..95a3803 100644
--- a/api/src/index.ts
+++ b/api/src/index.ts
@@ -4,6 +4,7 @@ import { logger } from "hono/logger";
 import { mainRouter } from "./routers.js";
 
 import { cors } from "hono/cors";
+import { config } from "./config.js";
 
 const app = new Hono();
 
@@ -11,7 +12,7 @@ app.use(logger());
 
 app.use("*", async (c, next) => {
   const corsMiddleware = cors({
-    origin: process.env.FRONTEND_URL || "http://localhost:5173",
+    origin: config.CORS_ORIGIN,
     allowHeaders: [
       "Authorization",
       "Content-Type",