diff --git a/config.go b/config.go
index e685261..1db0688 100644
--- a/config.go
+++ b/config.go
@@ -10,10 +10,11 @@ import (
 )
 
 type ServerConfig struct {
-	LogLevel   string             `toml:"LogLevel"`
-	URL        string             `toml:"URL"`
-	ListenAddr string             `toml:"ListenAddr"`
-	Store      *ServerStoreConfig `toml:"Store"`
+	LogLevel      string             `toml:"LogLevel"`
+	URL           string             `toml:"URL"`
+	ListenAddr    string             `toml:"ListenAddr"`
+	SigningSecret string             `toml:"SigningSecret"`
+	Store         *ServerStoreConfig `toml:"Store"`
 }
 
 type ServerStoreConfig struct {
@@ -54,6 +55,10 @@ func (sc *ServerConfig) updateFromEnv() {
 		sc.ListenAddr = value
 	}
 
+	if value, ok := os.LookupEnv("GPASTE_SIGNINGSECRET"); ok {
+		sc.SigningSecret = value
+	}
+
 	if value, ok := os.LookupEnv("GPASTE_STORE_TYPE"); ok {
 		sc.Store.Type = value
 	}
diff --git a/config_test.go b/config_test.go
index 4d18e20..4e9a676 100644
--- a/config_test.go
+++ b/config_test.go
@@ -16,6 +16,7 @@ func TestServerConfig(t *testing.T) {
 LogLevel = "INFO"
 URL = "http://paste.example.org"
 ListenAddr = ":8080"
+SigningSecret = "abc999"
 
 [Store]
 Type = "fs"
@@ -23,9 +24,10 @@ Type = "fs"
 Dir = "/tmp"
 `
 		expected := &gpaste.ServerConfig{
-			LogLevel:   "INFO",
-			URL:        "http://paste.example.org",
-			ListenAddr: ":8080",
+			LogLevel:      "INFO",
+			URL:           "http://paste.example.org",
+			ListenAddr:    ":8080",
+			SigningSecret: "abc999",
 			Store: &gpaste.ServerStoreConfig{
 				Type: "fs",
 				FS: &gpaste.ServerStoreFSStoreConfig{
@@ -48,16 +50,18 @@ Dir = "/tmp"
 		clearEnv()
 
 		var envMap map[string]string = map[string]string{
-			"GPASTE_LOGLEVEL":     "DEBUG",
-			"GPASTE_URL":          "http://gpaste.example.org",
-			"GPASTE_STORE_TYPE":   "fs",
-			"GPASTE_LISTENADDR":   ":8000",
-			"GPASTE_STORE_FS_DIR": "/tmp",
+			"GPASTE_LOGLEVEL":      "DEBUG",
+			"GPASTE_URL":           "http://gpaste.example.org",
+			"GPASTE_STORE_TYPE":    "fs",
+			"GPASTE_LISTENADDR":    ":8000",
+			"GPASTE_SIGNINGSECRET": "test1345",
+			"GPASTE_STORE_FS_DIR":  "/tmp",
 		}
 		expected := &gpaste.ServerConfig{
-			LogLevel:   "DEBUG",
-			URL:        "http://gpaste.example.org",
-			ListenAddr: ":8000",
+			LogLevel:      "DEBUG",
+			URL:           "http://gpaste.example.org",
+			ListenAddr:    ":8000",
+			SigningSecret: "test1345",
 			Store: &gpaste.ServerStoreConfig{
 				Type: "fs",
 				FS: &gpaste.ServerStoreFSStoreConfig{
diff --git a/http.go b/http.go
index 9acda18..0580a6b 100644
--- a/http.go
+++ b/http.go
@@ -30,7 +30,7 @@ func NewHTTPServer(cfg *ServerConfig) *HTTPServer {
 	}
 	srv.Files = NewMemoryFileStore()
 	srv.Users = NewMemoryUserStore()
-	srv.Auth = NewAuthService(srv.Users, []byte("test1235"))
+	srv.Auth = NewAuthService(srv.Users, []byte(srv.config.SigningSecret))
 
 	r := chi.NewRouter()
 	r.Use(middleware.RealIP)
diff --git a/http_test.go b/http_test.go
index 8ecc89d..b99d4aa 100644
--- a/http_test.go
+++ b/http_test.go
@@ -15,6 +15,7 @@ import (
 
 func TestHandlers(t *testing.T) {
 	cfg := &gpaste.ServerConfig{
+		SigningSecret: "abc123",
 		Store: &gpaste.ServerStoreConfig{
 			Type: "memory",
 		},