diff --git a/bbpay.ts b/bbpay.ts
index 7296343..8b91090 100644
--- a/bbpay.ts
+++ b/bbpay.ts
@@ -18,7 +18,7 @@ const primus = new Primus(config.primus, (...args) => log.info(...args));
 const cache = new ProofCache();
 
 const app = express();
-app.use(cors());
+app.use(cors({ origin: /^https?:\/\/(([a-z0-9-]+\.)*demo\.)?p2pix\.co$/ }));
 app.use(express.json());
 /** Only what the caller actually sent; empty sections stay out of the line. */
 const received = (req: Request): Record<string, unknown> =>