diff --git a/.env.example b/.env.example
index 3eee009..0a5b09d 100644
--- a/.env.example
+++ b/.env.example
@@ -5,10 +5,13 @@ MCP_SERVER_NAME=mt-odoo-mcp
 MCP_LOG_LEVEL=INFO
 
 # Base URL clients use to reach this server — shown in signup/regen-key API responses
-PUBLIC_URL=https://odoo-mcp.thedomainnest.com
+# No trailing slash — the frontend and this server both concatenate paths onto this directly.
+PUBLIC_URL=https://api.getodoomcp.com
 
-# Comma-separated list of origins allowed to call the API from a browser (the frontend domain)
-CORS_ORIGINS=http://localhost:3000
+# Comma-separated list of origins allowed to call the API from a browser (the frontend domain).
+# Must exactly match the frontend's origin (scheme + host, no trailing slash) or the browser
+# will block every request with a CORS error.
+CORS_ORIGINS=https://getodoomcp.com
 
 # ─── Security (generate strong random values for production) ─────────────────
 # Currently unused by the app (reserved for future signed tokens) — set anyway for forward compat
@@ -37,8 +40,8 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM_EMAIL=no-reply@odoomcp.cloud
-# Used to build the reset-password link sent to users
-FRONTEND_BASE_URL=http://localhost:3000
+# Used to build the reset-password link sent to users — no trailing slash
+FRONTEND_BASE_URL=https://getodoomcp.com
 
 # ─── Admin Panel ────────────────────────────────────────────────────────────────
 # Single hardcoded operator identity for /admin — not a row in the users table.