How to set CORS whitelist

I have checked .env-sample and there doesn't seem to be any parameter for whitelisting machines for CORS. I'm trying to access the API on my local network from my astro dev server via a fetch call, but btc-explorer keeps responding with Error HTTP 401: Unauthorized. Sorry I'm a noob, I'm not sure how to fix this.