diff --git a/api/Pipfile b/api/Pipfile
index d39257b..c0c081f 100644
--- a/api/Pipfile
+++ b/api/Pipfile
@@ -8,6 +8,7 @@ django = "==5.0.2"
 djangorestframework = "==3.14.0"
 pandas = "*"
 django-cors-headers = "*"
+python-dotenv = "*"
 
 [dev-packages]
 
diff --git a/api/Pipfile.lock b/api/Pipfile.lock
index 01ca358..0dab020 100644
--- a/api/Pipfile.lock
+++ b/api/Pipfile.lock
@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "ae0fd64da1a6ba308a4ef9796f6cf1300e15a871d05775c966137d67f82a5c11"
+            "sha256": "b590882aad39df4bf0d74735de19989d389b87e01c99ee3ca008c39cce95aab1"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -137,6 +137,15 @@
             "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
             "version": "==2.9.0.post0"
         },
+        "python-dotenv": {
+            "hashes": [
+                "sha256:e324ee90a023d808f1959c46bcbc04446a10ced277783dc6ee09987c37ec10ca",
+                "sha256:f7b63ef50f1b690dddf550d03497b66d609393b40b564ed0d674909a68ebf16a"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '3.8'",
+            "version": "==1.0.1"
+        },
         "pytz": {
             "hashes": [
                 "sha256:2a29735ea9c18baf14b448846bde5a48030ed267578472d8955cd0e7443a9812",
diff --git a/api/masteriq/settings.py b/api/masteriq/settings.py
index 0766c8c..f75db77 100644
--- a/api/masteriq/settings.py
+++ b/api/masteriq/settings.py
@@ -12,6 +12,9 @@
 
 from pathlib import Path
 import os
+from dotenv import load_dotenv
+
+load_dotenv()
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
@@ -21,16 +24,16 @@
 # See https://docs.djangoproject.com/en/5.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-^=xy+akjf7r600zo6r+_5fku9!1aw)hhf_&feny8r3@6ds%rds'
+SECRET_KEY = os.getenv('SECRET_KEY')
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.getenv('DEBUG')
 
 ALLOWED_HOSTS = []
 
 CORS_ALLOWED_ORIGINS = [
-    "http://localhost:5173",
-    "http://127.0.0.1:5173",
+    os.getenv('FRONTEND_URL'),
+    os.getenv('BACKEND_URL'),
 ]
 
 # Application definition
diff --git a/api/requirements.txt b/api/requirements.txt
index beebb28..5d7a11c 100644
Binary files a/api/requirements.txt and b/api/requirements.txt differ