diff --git a/README.md b/README.md
index 9fec0fd..7bafc64 100644
--- a/README.md
+++ b/README.md
@@ -18,10 +18,11 @@ TODO
 
 ### Environment variables
 
-| Name        | Type   | Description                           | Comment                                 |
-|-------------|--------|---------------------------------------|-----------------------------------------|
-| PORT        | int    | The port the API will use             | required                                |
-| ENVIRONMENT | string | The environment the API is running in | required, `development` or `production` |
+| Name                 | Type   | Description                           | Comment                                 |
+|----------------------|--------|---------------------------------------|-----------------------------------------|
+| ENVIRONMENT          | string | The environment the API is running in | required, `development` or `production` |
+| PORT                 | int    | The port the API will use             | required                                |
+| CORS_ALLOWED_ORIGINS | string | The allowed origins for CORS          | required, semicolon separated list      |
 
 ## API Usage
 
diff --git a/cmd/main.go b/cmd/main.go
index 4a9881a..ac7f6d3 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -12,9 +12,10 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strings"
 )
 
-var envVarsToLoad = []string{"PORT", "ENVIRONMENT"}
+var envVarsToLoad = []string{"PORT", "ENVIRONMENT", "CORS_ALLOWED_ORIGINS"}
 
 func jsonContentTypeMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -70,9 +71,8 @@ func initRoutes() *chi.Mux {
 	frontend := initFrontendRoutes()
 
 	apiRouter := chi.NewRouter()
-	// TODO use env variable for allowed origins
 	apiRouter.Use(cors.Handler(cors.Options{
-		AllowedOrigins:   []string{"https://*", "http://*"},
+		AllowedOrigins:   strings.Split(os.Getenv("CORS_ALLOWED_ORIGINS"), ";"),
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
@@ -104,7 +104,7 @@ func main() {
 	initJwt()
 	router := initRoutes()
 
-	fmt.Println("Server starting on port " + os.Getenv("PORT"))
+	fmt.Println("Server starting on http://localhost:" + os.Getenv("PORT"))
 	err := http.ListenAndServe(":"+os.Getenv("PORT"), router)
 	if err != nil {
 		panic(err)