In addition to Michaels correct answer:
It is also possible to define the AllowedCorsOrigins pipe-separated.
I also stuck on this and found the description in the IdentityServer WDP zip (parameters.xml):
<parameter name="AllowedCorsOrigins" description="Pipe-separated list of instances (URIs) that are allowed to login via Sitecore Identity.">
<parameterEntry kind="TextFile" scope="website\\config\\production\\Sitecore.IdentityServer.Host\.xml" match="PlaceholderForClientOriginsGroup" />
</parameter>
You can define the Origins like that:
<AllowedCorsOrigins>
<AllowedCorsOriginsGroup1>http://sc910.dev.sc.local|https://sc910.dev.sc.local</AllowedCorsOriginsGroup1>
<AllowedCorsOriginsGroup2>http://otherhost.dev.sc.local|https://otherhost.dev.sc.local</AllowedCorsOriginsGroup2>
</AllowedCorsOrigins>