diff --git a/src/constant/index.ts b/src/constant/index.ts
index 7a8e5d1..8c1cfd9 100644
--- a/src/constant/index.ts
+++ b/src/constant/index.ts
@@ -15,9 +15,9 @@ export const validatorsStakingNetworks = [
 ]
 
 export const VALIDATOR_STAKING_REWARDS_API_KEY = 'f00511ab0c5e422796b8f5d9c7029fbe'
-// export const ONFINALITY_API_KEY = 'e75486ad-bbb5-4b93-8699-3123f8dbabc5'
+export const ONFINALITY_API_KEY = 'e75486ad-bbb5-4b93-8699-3123f8dbabc5'
 
-export const ONFINALITY_API_KEY = '28209e0e-fc76-481e-a80f-745ffdf477d7' // test api key for localhost
+// export const ONFINALITY_API_KEY = '28209e0e-fc76-481e-a80f-745ffdf477d7' // test api key for localhost
 
 
 export const SUBSOCIAL_GRAPHQL_CLIENT = 'https://squid.subsquid.io/subsocial/graphql'
diff --git a/src/server.ts b/src/server.ts
index 9ebbcda..c9cbf5b 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -1,7 +1,7 @@
 import express from 'express'
 import cors from 'cors'
 import timeout from 'connect-timeout'
-import { reqTimeoutSecs, port } from './constant/env'
+import { reqTimeoutSecs, port, allowedOrigins } from './constant/env'
 import { newLogger } from '@subsocial/utils'
 
 import { createRoutes } from './routes'
@@ -22,28 +22,28 @@ export const startHttpServer = (apis: Connections) => {
 
   app.use(express.static('public'))
 
-  // app.use(
-  //   cors((req, callback) => {
-  //     const corsOptions = { origin: true }
-  //     const origin = req.header('Origin')
-  //     const isAllowedOrigin = allowedOrigins.some((allowedOrigin) =>
-  //       origin?.includes(allowedOrigin)
-  //     )
-  //     if (!isAllowedOrigin) {
-  //       corsOptions.origin = false
-  //     }
-  //     callback(null, corsOptions)
-  //   })
-  // )
-
-  // For localhost testing 
   app.use(
     cors((req, callback) => {
-      const origin = req.method === 'GET' ? '*' : '*'
-      callback(null, { origin })
+      const corsOptions = { origin: true }
+      const origin = req.header('Origin')
+      const isAllowedOrigin = allowedOrigins.some((allowedOrigin) =>
+        origin?.includes(allowedOrigin)
+      )
+      if (!isAllowedOrigin) {
+        corsOptions.origin = false
+      }
+      callback(null, corsOptions)
     })
   )
 
+  // For localhost testing 
+  // app.use(
+  //   cors((req, callback) => {
+  //     const origin = req.method === 'GET' ? '*' : '*'
+  //     callback(null, { origin })
+  //   })
+  // )
+
   function haltOnTimedout(req: express.Request, _res: express.Response, next) {
     if (!req.timedout) next()
   }