diff --git a/fm/config/default.py b/fm/config/default.py
index f541518..a596b1e 100644
--- a/fm/config/default.py
+++ b/fm/config/default.py
@@ -56,6 +56,7 @@
 
 CORS_ACA_EXPOSE_HEADERS = ['Link', 'Total-Pages', 'Total-Count', 'Auth-Token']
 CORS_ACA_HEADERS = ['Content-Type', 'Auth-Token']
+CORS_ACA_ORIGIN = os.environ.get('CORS_ACA_ORIGIN', '*')
 
 # Google OAuth
 GOOGLE_ALLOWED_DOMAINS = [