diff --git a/src/app.py b/src/app.py
index 678c23e..753892c 100644
--- a/src/app.py
+++ b/src/app.py
@@ -15,7 +15,10 @@
 
 def create_app() -> Flask:
     app = Flask(__name__)
-    app.secret_key = "billing-api-local-dev"
+    secret_key = os.environ.get("SECRET_KEY")
+    if not secret_key:
+        raise ValueError("SECRET_KEY environment variable is required")
+    app.secret_key = secret_key
 
     app.register_blueprint(auth_bp, url_prefix="/auth")
     app.register_blueprint(admin_bp, url_prefix="/api/admin")