diff --git a/fpx-app/src/api_manager/fpx_api.rs b/fpx-app/src/api_manager/fpx_api.rs
index e069ed529..5ee8f34a7 100644
--- a/fpx-app/src/api_manager/fpx_api.rs
+++ b/fpx-app/src/api_manager/fpx_api.rs
@@ -66,6 +66,7 @@ impl ApiManager {
 
             let app = api::Builder::new()
                 .enable_compression()
+                .allow_origin_any()
                 .build(service.clone(), store.clone());
 
             let listener = tokio::net::TcpListener::from_std(listener).unwrap();
diff --git a/fpx/src/api.rs b/fpx/src/api.rs
index c843edec5..a82f5967e 100644
--- a/fpx/src/api.rs
+++ b/fpx/src/api.rs
@@ -32,6 +32,7 @@ impl FromRef<ApiState> for Service {
 
 #[derive(Default)]
 pub struct Builder {
+    allow_origin_any: bool,
     enable_compression: bool,
 }
 
@@ -40,6 +41,11 @@ impl Builder {
         Self::default()
     }
 
+    pub fn allow_origin_any(mut self) -> Self {
+        self.allow_origin_any = true;
+        self
+    }
+
     pub fn set_compression(mut self, compression: bool) -> Self {
         self.enable_compression = compression;
         self
@@ -49,11 +55,11 @@ impl Builder {
         self.set_compression(true)
     }
 
-    /// Create a API and expose it through a axum router.
+    /// Create an API and expose it through an axum router.
     pub fn build(self, service: Service, store: BoxedStore) -> axum::Router {
         let api_state = ApiState { service, store };
 
-        let router = axum::Router::new()
+        let mut router = axum::Router::new()
             .route("/v1/traces", post(handlers::otel::trace_collector_handler))
             .route("/v1/traces", get(handlers::traces::traces_list_handler))
             .route(
@@ -75,14 +81,17 @@ impl Builder {
             )
             .with_state(api_state)
             .fallback(StatusCode::NOT_FOUND)
-            .layer(CorsLayer::new().allow_origin(Any))
             .layer(OtelTraceLayer::default())
             .layer(RequestDecompressionLayer::new());
 
+        if self.allow_origin_any {
+            router = router.layer(CorsLayer::new().allow_origin(Any));
+        }
+
         if self.enable_compression {
-            router.layer(CompressionLayer::new())
-        } else {
-            router
+            router = router.layer(CompressionLayer::new());
         }
+
+        router
     }
 }