diff --git a/lib/mvcfronk/mfBase/mfBaseApicontroller.php b/lib/mvcfronk/mfBase/mfBaseApicontroller.php
index 88a881310..00ca4a70d 100644
--- a/lib/mvcfronk/mfBase/mfBaseApicontroller.php
+++ b/lib/mvcfronk/mfBase/mfBaseApicontroller.php
@@ -43,6 +43,13 @@ class mfBaseApicontroller {
     
     register_shutdown_function(["mfBaseApicontroller", "return_errors"]);
 
+    // allow origins from config file
+    if(defined("API_CORS_ALLOWED_HOSTNAMES") && is_array(API_CORS_ALLOWED_HOSTNAMES)) {
+      foreach(API_CORS_ALLOWED_HOSTNAMES as $origin) {
+        $this->addAllowedOrigin($origin);
+      }
+    }
+    
     // CORS preflight
     // allow all origins
     if($this->http_method == "OPTIONS") {
@@ -71,7 +78,7 @@ class mfBaseApicontroller {
     if($this->requireAuth) {
       $this->authenticateUser();
       if(method_exists($this,"authenticated")) {
-        $this->authenticated();
+        $this->authenticated(); // event defined in extending class
       }
     }