diff --git a/next.config.ts b/next.config.ts
index c9c717f94..5498ad8da 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -40,6 +40,8 @@ function normalizePath(url: string) {
 }
 
 const apiUrlOrigin = getUrlOrigin(apiUrl);
+const isAbsoluteApiUrl = Boolean(apiUrlOrigin);
+const allowOrigin = isAbsoluteApiUrl && cloudUrl ? cloudUrl : '*';
 const connectSrc = ["'self'", 'https:', apiUrlOrigin].filter(Boolean).join(' ');
 
 const contentSecurityPolicy = `
@@ -84,8 +86,14 @@ const trackerHeaders = [
 const apiHeaders = [
   {
     key: 'Access-Control-Allow-Origin',
-    value: '*',
+    value: allowOrigin,
   },
+  ...(allowOrigin !== '*'
+    ? [
+        { key: 'Access-Control-Allow-Credentials', value: 'true' },
+        { key: 'Vary', value: 'Origin' },
+      ]
+    : []),
   {
     key: 'Access-Control-Allow-Headers',
     value: '*',