diff --git a/cli/src/cordova.ts b/cli/src/cordova.ts
index ef36d9eb0a..30b01e5150 100644
--- a/cli/src/cordova.ts
+++ b/cli/src/cordova.ts
@@ -249,6 +249,19 @@ export async function autoGenerateConfig(
     }
   });
 
+  let accessOriginString: string[] = [];
+  if (config.app.extConfig?.cordova?.accessOrigins) {
+    accessOriginString = await Promise.all(
+      config.app.extConfig.cordova.accessOrigins.map(
+        async (host): Promise<string> => {
+          return `
+  <access origin="${host}" />`;
+        },
+      ),
+    );
+  } else {
+    accessOriginString.push(`<access origin="*" />`);
+  }
   const pluginEntriesString: string[] = await Promise.all(
     pluginEntries.map(async (item): Promise<string> => {
       const xmlString = await writeXML(item);
@@ -268,7 +281,7 @@ export async function autoGenerateConfig(
   }
   const content = `<?xml version='1.0' encoding='utf-8'?>
 <widget version="1.0.0" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0">
-  <access origin="*" />
+  ${accessOriginString.join('')}
   ${pluginEntriesString.join('')}
   ${pluginPreferencesString.join('')}
 </widget>`;
diff --git a/cli/src/declarations.ts b/cli/src/declarations.ts
index b4564b86ec..570a6ff4b4 100644
--- a/cli/src/declarations.ts
+++ b/cli/src/declarations.ts
@@ -426,6 +426,16 @@ export interface CapacitorConfig {
   };
 
   cordova?: {
+    /**
+     * Populates <access> tags in the config.xml with the origin set to
+     * the values entered here.
+     * If not provided, a single <access origin="*" /> tag gets included.
+     * It only has effect on a few Cordova plugins that respect the whitelist.
+     *
+     * @since 3.3.0
+     */
+    accessOrigins?: string[];
+
     /**
      * Configure Cordova preferences.
      *