diff --git a/src/.env.example b/src/.env.example
index 6fb3de6..44fb3ea 100644
--- a/src/.env.example
+++ b/src/.env.example
@@ -4,6 +4,7 @@ APP_KEY=
 APP_DEBUG=true
 APP_TIMEZONE=UTC
 APP_URL=http://localhost
+FRONTEND_URL=http://localhost:3876
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
diff --git a/src/config/cors.php b/src/config/cors.php
index 2de0729..283dd6b 100644
--- a/src/config/cors.php
+++ b/src/config/cors.php
@@ -4,13 +4,18 @@
     'paths' => ['api/*', 'sanctum/csrf-cookie'],
     'allowed_methods' => ['*'],
     'allowed_origins' => [
-        'http://localhost:3876',
-        'http://127.0.0.1:5173',
+        env('FRONTEND_URL', 'http://localhost:3876'),
         'https://zigzagdev.github.io',
     ],
     'allowed_origins_patterns' => [],
     'allowed_headers' => ['*'],
     'exposed_headers' => [],
     'max_age' => 0,
-    'supports_credentials' => false,
+
+    // Sanctum's cookie-based SPA auth sends requests with `credentials: 'include'`.
+    // If this is false, the browser will discard the session cookie on cross-origin
+    // responses even though the cookie itself was issued successfully, so the
+    // frontend appears logged in but authenticated requests (e.g. fetching the
+    // current user) fail silently.
+    'supports_credentials' => true,
 ];
\ No newline at end of file
diff --git a/src/config/sanctum.php b/src/config/sanctum.php
index ff9ca03..c96de92 100644
--- a/src/config/sanctum.php
+++ b/src/config/sanctum.php
@@ -5,6 +5,15 @@
 use Laravel\Sanctum\Http\Middleware\AuthenticateSession;
 use Laravel\Sanctum\Sanctum;
 
+$frontendUrl  = env('FRONTEND_URL', 'http://localhost:3876');
+$frontendHost = parse_url($frontendUrl, PHP_URL_HOST);
+$frontendPort = parse_url($frontendUrl, PHP_URL_PORT);
+
+// Sanctum only treats requests from a listed domain/host as cookie-based SPA
+// requests; anything else falls back to requiring a bearer token. The frontend
+// (FRONTEND_URL) must be listed here or its session cookie is never checked.
+$frontendStatefulDomain = $frontendPort ? "{$frontendHost}:{$frontendPort}" : $frontendHost;
+
 return [
 
     /*
@@ -19,8 +28,9 @@
     */
 
     'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', sprintf(
-        '%s%s',
+        '%s,%s%s',
         'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1',
+        $frontendStatefulDomain,
         Sanctum::currentApplicationUrlWithPort(),
         // Sanctum::currentRequestHost(),
     ))),