diff --git a/app/api/display/events/route.ts b/app/api/display/events/route.ts
index a79ff8e..0f332ef 100644
--- a/app/api/display/events/route.ts
+++ b/app/api/display/events/route.ts
@@ -2,8 +2,8 @@ import { NextResponse } from "next/server";
 import { db } from "@/lib/db";
 
 function isAuthorized(req: Request): boolean {
-  const key = process.env.DISPLAY_API_KEY;
-  if (!key) return false; // key must be set
+  const key = process.env.API_SECRET_KEY;
+  if (!key) return false;
   return req.headers.get("x-display-key") === key;
 }
 
diff --git a/esp32/firmware/config.h b/esp32/firmware/config.h
index 3ab2584..681c6f5 100644
--- a/esp32/firmware/config.h
+++ b/esp32/firmware/config.h
@@ -8,7 +8,7 @@
 // IP or hostname of your VFX Review server — no trailing slash
 #define SERVER_HOST     "192.168.1.100"
 #define SERVER_PORT     3000
-#define DISPLAY_API_KEY "your-display-api-key-here"  // must match .env DISPLAY_API_KEY
+#define DISPLAY_API_KEY "your-api-secret-key-here"  // value of API_SECRET_KEY in .env
 
 // ── MAX7219 hardware (hardware SPI) ──────────────────────────────────────────
 //   Module:  4 × 8×8 MAX7219 daisy-chained  =  8×32 display