diff --git a/.gitignore b/.gitignore
index 021954c..4cd0ae1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
 agent_gateway.db
-node_modules/
 .env
 mcp-bridge/node_modules
+node_modules/
diff --git a/ecosystem.config.js b/ecosystem.config.js
index d3de3c3..b9dced1 100644
--- a/ecosystem.config.js
+++ b/ecosystem.config.js
@@ -1,10 +1,19 @@
+require('dotenv').config({ path: __dirname + '/.env' });
+
+const HUB_SECRET = process.env.HUB_SECRET;
+if (!HUB_SECRET) throw new Error('HUB_SECRET not set in .env');
+
 module.exports = {
   apps: [
     {
       name: 'mcp-hub',
       script: 'src/index.js',
       cwd: '/workspace',
-      env: { NODE_ENV: 'development', PORT: 3000, HUB_AUTH: JSON.stringify({"sample-mcp": "cd36b91af1224e2d365ede4e32385ea03508b4bd4c05411e2fc76388d62c6886", "memory-mcp": "cd36b91af1224e2d365ede4e32385ea03508b4bd4c05411e2fc76388d62c6886"}) },
+      env: {
+        NODE_ENV: 'development',
+        PORT: 3000,
+        HUB_AUTH: JSON.stringify({ 'sample-mcp': HUB_SECRET, 'memory-mcp': HUB_SECRET })
+      },
       max_restarts: 10,
       restart_delay: 1000,
       log_date_format: 'YYYY-MM-DD HH:mm:ss Z',
@@ -14,7 +23,10 @@ module.exports = {
       name: 'sample-mcp',
       script: 'sample-mcp/index.js',
       cwd: '/workspace',
-      env: { NODE_ENV: 'development', MCP_SECRET: 'cd36b91af1224e2d365ede4e32385ea03508b4bd4c05411e2fc76388d62c6886' },
+      env: {
+        NODE_ENV: 'development',
+        MCP_SECRET: HUB_SECRET
+      },
       max_restarts: 10,
       restart_delay: 2000,
       log_date_format: 'YYYY-MM-DD HH:mm:ss Z',
@@ -26,7 +38,7 @@ module.exports = {
       cwd: '/workspace',
       env: {
         BRIDGE_SERVICE_ID: 'memory-mcp',
-        BRIDGE_SECRET: 'cd36b91af1224e2d365ede4e32385ea03508b4bd4c05411e2fc76388d62c6886',
+        BRIDGE_SECRET: HUB_SECRET,
         BRIDGE_HUB_URL: 'ws://localhost:3000/ws/register',
         BRIDGE_UPSTREAM_URL: 'https://memory-mcp.dbchat.ai/mcp/sse'
       },
diff --git a/package-lock.json b/package-lock.json
index 6566ff3..5565d3c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,7 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
+        "dotenv": "^17.3.1",
         "express": "^5.2.1",
         "uuid": "^13.0.0",
         "ws": "^8.19.0"
@@ -155,6 +156,18 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/dotenv": {
+      "version": "17.3.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.3.1.tgz",
+      "integrity": "sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/package.json b/package.json
index e8d1180..b4d6406 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
   "license": "ISC",
   "description": "",
   "dependencies": {
+    "dotenv": "^17.3.1",
     "express": "^5.2.1",
     "uuid": "^13.0.0",
     "ws": "^8.19.0"