CORS allowlist

server.cors.allowed_origins is an allowlist of origin patterns. It only matters for browser callers (a SPA hitting the API) - programmatic clients (CLI, server-to-server, MCP) aren't subject to CORS.

Configure it

[server.cors]
allowed_origins = [
  "https://app.example.com",   # exact
  "https://*.example.com",     # any subdomain: a.example.com, a.b.example.com
  "http://localhost:*",        # any localhost port (dev)
]
allow_credentials = true
max_age_secs = 86400

Each entry matches literally or as a glob via * (multi-level - * matches across dots).

Security rules (enforced at boot)

The server validates this at startup:

• A bare * origin with allow_credentials = true is fatal - browsers reject it, so every credentialed request would silently fail. Boot stops.
• Over-broad globs plus an all-localhost allowlist behind an https:// public_url log a startup warning. Keep patterns specific.

What's intentionally outside CORS

These paths don't need preflight and are excluded by design:

• /v1/oauth/* and /.well-known/* - programmatic OAuth flows and browser redirects.
• /mcp - MCP clients are programmatic and have their own origin / DNS-rebinding protection.

Production

Lock allowed_origins to your real SPA host(s) and drop the localhost wildcard before exposing the stack - see the Production checklist.

Next

• TLS termination · Web UI (sets its own origin).