# Backend CORS for LaunchPad (DigitalOcean)

The browser loads the app from **https://orca-app-l2vba.ondigitalocean.app** and calls the API at **https://launchpad-api-ijyrm.ondigitalocean.app/api**. The API must allow that origin.

## On the API app (DigitalOcean → Environment Variables)

```env
BACKEND_URL=https://launchpad-api-ijyrm.ondigitalocean.app
FRONTEND_URL=https://orca-app-l2vba.ondigitalocean.app
CORS_ORIGINS=https://orca-app-l2vba.ondigitalocean.app
```

`*.ondigitalocean.app` origins are also allowed by default in `backend/src/app.js`, but setting `CORS_ORIGINS` explicitly is recommended.

## Frontend build-time

```env
NEXT_PUBLIC_API_URL=https://launchpad-api-ijyrm.ondigitalocean.app/api
NEXT_PUBLIC_APP_URL=https://orca-app-l2vba.ondigitalocean.app
```

Rebuild the frontend after changing these (they are inlined at build time).

## Health check

`GET https://launchpad-api-ijyrm.ondigitalocean.app/health` only proves the API process is running. It does not replace correct `NEXT_PUBLIC_API_URL` or CORS configuration.