diff --git a/server.js b/server.js
index 5eccdbe..ef6594a 100644
--- a/server.js
+++ b/server.js
@@ -42,12 +42,15 @@ app.use(morgan("dev"));
 app.use(sanitizeInput);
 
 // app.use(cors());
-const allowedOrigins = [
-  "http://localhost:5173",     //local
-  "http://13.201.47.205:5173", //dev
-  "http://13.201.47.205:5175",  //uat
-  "https://ipi.venbait.in/api"  // backend
-];
+// const allowedOrigins = [
+//   "http://localhost:5173",     //local
+//   "http://13.201.47.205:5173", //dev
+//   "http://13.201.47.205:5175",  //uat
+//   "https://ipi.venbait.in/api"  // backend
+// ];
+const allowedOrigins = process.env.ALLOWED_ORIGINS
+  ? process.env.ALLOWED_ORIGINS.split(",").map(origin => origin.trim())
+  : [];
 app.use(cors({
   origin: allowedOrigins,
   credentials: true