diff --git a/local_translator/config.py b/local_translator/config.py
index c4a4753..319e6e3 100644
--- a/local_translator/config.py
+++ b/local_translator/config.py
@@ -2,7 +2,7 @@ from pathlib import Path
 import tomllib
 from typing import Literal
 
-from pydantic import BaseModel, ConfigDict, Field, field_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
 
 class ProviderConfig(BaseModel):
@@ -23,6 +23,13 @@ class ProviderConfig(BaseModel):
     load_model: str = ""
     load_context_length: int = Field(default=8192, ge=512, le=262144)
 
+    @model_validator(mode="before")
+    @classmethod
+    def misplaced_top_level_key(cls, data):
+        if isinstance(data, dict) and "allowed_origins" in data:
+            raise ValueError("allowed_origins is a top-level setting: move it above the first [section] in config.toml")
+        return data
+
     @field_validator("base_url")
     @classmethod
     def validate_url(cls, value: str) -> str: