<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Allowed Origins
    |--------------------------------------------------------------------------
    |
    | These are the origins (domains) that are allowed to make requests to
    | your API. These origins are used for both CORS validation and for
    | generating password reset links that point back to the frontend.
    |
    | Set the ALLOWED_ORIGINS environment variable as a comma-separated list:
    | ALLOWED_ORIGINS="http://localhost,https://localhost,https://myapp.com"
    |
    | If not set, defaults to localhost for local development.
    |
    */

    'allowed_origins' => env('ALLOWED_ORIGINS')
        ? array_map('trim', explode(',', env('ALLOWED_ORIGINS')))
        : [
            'http://localhost',
            'https://localhost',
            'http://127.0.0.1',
            'https://127.0.0.1',
        ],

];

