diff --git a/api.js b/api.js
index d3a9e105..857d24bc 100644
--- a/api.js
+++ b/api.js
@@ -144,7 +144,7 @@ if (config.api.secure && certOptions.key) {
 const server = restify.createServer(serverOptions);
 
 const cors = corsMiddleware({
-    origins: [].concat(config.api.cors.origins || ['*']),
+    origins: [].concat((config.api.cors && config.api.cors.origins) ? config.api.cors.origins : ['*']),
     allowHeaders: ['X-Access-Token'],
     allowCredentialsAllOrigins: true
 });