diff --git a/cmd/main/main.go b/cmd/main/main.go
index ed87403..012db9f 100644
--- a/cmd/main/main.go
+++ b/cmd/main/main.go
@@ -11,6 +11,7 @@ import (
 	"syscall"
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/rs/cors"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 	"google.golang.org/grpc"
@@ -33,16 +34,22 @@ import (
 	connectorPB "github.com/instill-ai/protogen-go/connector/v1alpha"
 )
 
-func grpcHandlerFunc(grpcServer *grpc.Server, gwHandler http.Handler) http.Handler {
+func grpcHandlerFunc(grpcServer *grpc.Server, gwHandler http.Handler, CORSOrigins []string) http.Handler {
 	return h2c.NewHandler(
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.ProtoMajor == 2 && strings.Contains(r.Header.Get("Content-Type"), "application/grpc") {
-				grpcServer.ServeHTTP(w, r)
-			} else {
-				gwHandler.ServeHTTP(w, r)
-			}
-		}),
-		&http2.Server{})
+		cors.New(cors.Options{
+			AllowedOrigins:   CORSOrigins,
+			AllowCredentials: true,
+			Debug:            false,
+		}).Handler(
+			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.ProtoMajor == 2 && strings.Contains(r.Header.Get("Content-Type"), "application/grpc") {
+					grpcServer.ServeHTTP(w, r)
+				} else {
+					gwHandler.ServeHTTP(w, r)
+				}
+			})),
+		&http2.Server{},
+	)
 }
 
 func main() {
@@ -141,7 +148,7 @@ func main() {
 
 	httpServer := &http.Server{
 		Addr:    fmt.Sprintf(":%v", config.Config.Server.Port),
-		Handler: grpcHandlerFunc(grpcS, gwS),
+		Handler: grpcHandlerFunc(grpcS, gwS, config.Config.Server.CORSOrigins),
 	}
 
 	// Wait for interrupt signal to gracefully shutdown the server with a timeout of 5 seconds.
diff --git a/config/config.go b/config/config.go
index a42c7b1..4478098 100644
--- a/config/config.go
+++ b/config/config.go
@@ -77,9 +77,12 @@ func Init() error {
 		logger.Fatal(err.Error())
 	}
 
-	if err := k.Load(env.Provider("CFG_", ".", func(s string) string {
-		return strings.Replace(strings.ToLower(
-			strings.TrimPrefix(s, "CFG_")), "_", ".", -1)
+	if err := k.Load(env.ProviderWithValue("CFG_", ".", func(s string, v string) (string, interface{}) {
+		key := strings.Replace(strings.ToLower(strings.TrimPrefix(s, "CFG_")), "_", ".", -1)
+		if strings.Contains(v, ",") {
+			return key, strings.Split(strings.TrimSpace(v), ",")
+		}
+		return key, v
 	}), nil); err != nil {
 		logger.Fatal(err.Error())
 	}
diff --git a/go.mod b/go.mod
index a1653eb..72b11de 100644
--- a/go.mod
+++ b/go.mod
@@ -24,7 +24,9 @@ require (
 require (
 	github.com/instill-ai/protogen-go v0.1.5-alpha.0.20220519185924-775d2feab526
 	github.com/instill-ai/x v0.1.0-alpha.0.20220517204940-5a70916ce425
+	github.com/jackc/pgconn v1.11.0
 	github.com/mennanov/fieldmask-utils v0.5.0
+	github.com/rs/cors v1.8.2
 )
 
 require (
@@ -37,7 +39,6 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.11.0
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgproto3/v2 v2.2.0 // indirect
diff --git a/go.sum b/go.sum
index bc15f06..2deff0e 100644
--- a/go.sum
+++ b/go.sum
@@ -926,6 +926,8 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rs/cors v1.8.2 h1:KCooALfAYGs415Cwu5ABvv9n9509fSiG5SQJn/AQo4U=
+github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=