Origins allowed to call the API from a browser. This is a CORS allowlist, not an auth mechanism: it only governs which web pages a browser will let read this API’s responses. The default “*” means any site open in your browser can send requests to this instance, which matters most when disable_auth is on. Restrict this to your own frontends to close that off, or use an empty list to block all browser (cross-origin) callers.

[
  "*"
]

[
  "http://localhost:8000"
]