diff --git a/environment/Caddyfile b/environment/Caddyfile
index e9b21bd..16a43d7 100644
--- a/environment/Caddyfile
+++ b/environment/Caddyfile
@@ -19,7 +19,10 @@ localhost {
 		respond 204
 	}
 
-	@authorized header X-Api-Key "supersecret123"
+	# Read from IGNIS_API_KEY at container start (see docker.env) rather than
+	# hardcoded here — a real key belongs in an untracked env file, not
+	# committed source.
+	@authorized header X-Api-Key {$IGNIS_API_KEY}
 	handle @authorized {
 		reverse_proxy ignis-app:{$APP_PORT:8080}
 	}
diff --git a/environment/docker.env b/environment/docker.env
index 2c60f99..a57f1a3 100644
--- a/environment/docker.env
+++ b/environment/docker.env
@@ -25,3 +25,8 @@ POSTGRES_DB=ignis
 # matcher (see docker-compose.yml + Caddyfile). Add an origin here once —
 # nothing to update in the Caddyfile itself.
 ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3000,http://localhost:8000,http://127.0.0.1:8000,https://thd-spatial-ai.github.io
+
+# Read by ignis-reverse-proxy's Caddyfile to gate the app behind the
+# X-Api-Key header. Callers must send this same value. Rotate before any
+# real deployment — this is a local-dev placeholder, not a secret.
+IGNIS_API_KEY=supersecret123