If you had to had to build the logic for the API to at least accept one other URL to the allowed origins, where would you start? I'm struggling to understand where the plugin API is setting things up.
Edit: Just found PluginMiddleware in Headers. It should be this one right?
Solution
why do you want to allow 2 origins anyway? If you're referring to both localhost and your production URL, you're supposed to separate your development and production environments to begin with. Never test/develop in production.