# Security & authentication

These variables configure browser access, local authentication, and encryption for Plane.

This feature is only available in the Enterprise version

These variables configure browser access, local authentication, and encryption for Plane.

```dotenv .env wrap
CORS_ORIGINS=http://localhost:8080,http://localhost:3001
JWT_SECRET=thisisasecret
BLNK_ENCRYPTION_KEY=0123456789abcdef0123456789abcdef
```

<ParamField name="CORS_ORIGINS" required>
Comma-separated list of browser origins allowed to call the Plane API. Do not include spaces. Include `ENTERPRISE_PUBLIC_URL` so the Cloud Dashboard can reach the API.
</ParamField>
<ParamField name="JWT_SECRET" required>
Strong random secret used to sign and verify local authentication tokens. Store this as a secret and keep it stable across restarts.
</ParamField>
<ParamField name="BLNK_ENCRYPTION_KEY" required>
Unique 32-character key used to encrypt sensitive data, including instance connection keys. Do not change it after deployment because existing encrypted data may become unreadable.
</ParamField>