diff --git a/apps/api/src/config/env.ts b/apps/api/src/config/env.ts
index 4d55f1b..0a36135 100644
--- a/apps/api/src/config/env.ts
+++ b/apps/api/src/config/env.ts
@@ -8,6 +8,12 @@ const googleOAuthEnabled = Boolean(
 );
 
 const webAppUrl = Bun.env.WEB_APP_URL ?? 'http://localhost:5173';
+const allowedOrigins = [
+  webAppUrl,
+  'https://tauri.localhost',
+  'tauri://localhost',
+  'http://localhost:5173',
+];
 const secureCookies = Bun.env.SECURE_COOKIES === 'true' || webAppUrl.startsWith('https://');
 
 export const env = {
@@ -24,6 +30,7 @@ export const env = {
   googleClientSecret: Bun.env.GOOGLE_CLIENT_SECRET,
   googleRedirectUri: Bun.env.GOOGLE_REDIRECT_URI,
   webAppUrl,
+  allowedOrigins,
   secureCookies,
 };
 
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 91d11be..a292675 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -17,7 +17,7 @@ assertRequiredEnv();
 
 const app = new Elysia()
   .use(cors({
-    origin: env.webAppUrl,
+    origin: env.allowedOrigins,
     credentials: true,
   }))
   .use(metricsRoutes)
diff --git a/apps/web/src/lib/api-client.ts b/apps/web/src/lib/api-client.ts
index fa1b7fa..4c5d0b9 100644
--- a/apps/web/src/lib/api-client.ts
+++ b/apps/web/src/lib/api-client.ts
@@ -14,7 +14,7 @@ import type {
 } from '@zeavis/shared';
 import { recordApiCall } from './telemetry';
 
-const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? '';
+const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? 'https://zeavisedu.asepharyana.my.id';
 
 export interface ApiError extends Error {
   status: number;