JWT authentication, The right way.

Yeah, you can request for their domains while they sign-up for your API, then store in a database, you then fetch all domains into an array/list is an accepted format in the cors origin option

Additionally, such APIs don't restrict which "origin" calls them. You probably want to pass the JWT as a header or something in that line.