diff --git a/backoffice/.env.example b/backoffice/.env.example
index 0edc61b..92e8016 100644
--- a/backoffice/.env.example
+++ b/backoffice/.env.example
@@ -2,3 +2,4 @@ DATABASE_URL=postgresql://user:password@host:port/dbname?schema=public
 JWT_SECRET=dev-secret
 PORT=3000
 API_URL=http://localhost:3000
+CORS_ORIGINS=*
diff --git a/backoffice/src/main.ts b/backoffice/src/main.ts
index afebe86..f57c2a9 100644
--- a/backoffice/src/main.ts
+++ b/backoffice/src/main.ts
@@ -13,6 +13,12 @@ async function bootstrap() {
   );
 
   const configService = app.get(ConfigService);
+  const corsOrigins = configService.get<string>('CORS_ORIGINS', '*');
+
+  app.enableCors({
+    origin: corsOrigins === '*' ? '*' : corsOrigins.split(','),
+    credentials: true,
+  });
 
   const cookieOptions: FastifyCookieOptions = {
     parseOptions: {