diff --git a/.env.example b/.env.example
index fe4fccc..8bc28d1 100644
--- a/.env.example
+++ b/.env.example
@@ -8,7 +8,7 @@ PURCHASE_CHECKOUT_EXPIRATION_MINUTES=30
 PURCHASE_QR_EXPIRATION_MINUTES=15
 PURCHASE_TELEPAGOS_EXPIRATION_MINUTES=30
 PURCHASE_TRANSFER_EXPIRATION_MINUTES=1440
-FRONTEND_URL=http://localhost:4200
+FRONTEND_URLS=http://localhost:4200
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
@@ -43,7 +43,7 @@ SESSION_LIFETIME=120
 SESSION_ENCRYPT=false
 SESSION_PATH=/
 SESSION_DOMAIN=null
-SANCTUM_STATEFUL_DOMAINS=localhost,127.0.0.1
+SANCTUM_STATEFUL_DOMAINS=localhost,127.0.0.1,*.shopit.com.ar
 SANCTUM_EXPIRATION=720
 SESSION_SECURE_COOKIE=false
 
diff --git a/config/cors.php b/config/cors.php
index 392a9d3..3dde969 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -1,5 +1,13 @@
 <?php
 
+$frontendUrls = array_values(array_filter(array_map(
+    'trim',
+    explode(',', (string) env(
+        'FRONTEND_URLS',
+        env('FRONTEND_URL', 'http://localhost:4200')
+    ))
+)));
+
 return [
 
     /*
@@ -19,9 +27,11 @@ return [
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => [env('FRONTEND_URL', 'http://localhost:4200')],
+    'allowed_origins' => $frontendUrls,
 
-    'allowed_origins_patterns' => [],
+    'allowed_origins_patterns' => [
+        '#^https://[a-z0-9-]+\.shopit\.com\.ar$#',
+    ],
 
     'allowed_headers' => ['*'],