diff --git a/keyserver/src/keyserver.js b/keyserver/src/keyserver.js
--- a/keyserver/src/keyserver.js
+++ b/keyserver/src/keyserver.js
@@ -91,8 +91,12 @@
 
   let keyserverCorsOptions = null;
   if (webAppCorsConfig) {
+    const origin =
+      typeof webAppCorsConfig.domain === 'string'
+        ? webAppCorsConfig.domain
+        : [...webAppCorsConfig.domain];
     keyserverCorsOptions = {
-      origin: webAppCorsConfig.domain,
+      origin,
       methods: ['GET', 'POST'],
     };
   }
diff --git a/keyserver/src/utils/urls.js b/keyserver/src/utils/urls.js
--- a/keyserver/src/utils/urls.js
+++ b/keyserver/src/utils/urls.js
@@ -84,7 +84,7 @@
   return urlFacts;
 }
 
-export type WebAppCorsConfig = { +domain: string };
+export type WebAppCorsConfig = { +domain: string | $ReadOnlyArray<string> };
 async function getWebAppCorsConfig(): Promise<?WebAppCorsConfig> {
   const config = await getCommConfig<WebAppCorsConfig>({
     folder: 'facts',