diff --git a/.env.example b/.env.example
index 87852f1..9068157 100755
--- a/.env.example
+++ b/.env.example
@@ -8,5 +8,4 @@ DATA_PATH=where_to_store_data
 NODE_ENV=production
 DISCORD_AI_WEBHOOK=discord_webhook_url
 PROCESSING_SERVER=https://git.ceres.rip/selenite/processing
-PROCESSING_SERVER_SECRET=secret
-PROXY_PASSWORD=change_me
\ No newline at end of file
+PROCESSING_SERVER_SECRET=secret
\ No newline at end of file
diff --git a/index.js b/index.js
index 05c6344..fa1f628 100755
--- a/index.js
+++ b/index.js
@@ -18,6 +18,7 @@ import { callAI } from "./ai.js";
 import { Readable } from 'stream';
 import os from "node:os";
 import crypto from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
 import { server as wisp, logging as wispLogging } from "@mercuryworkshop/wisp-js/server";
 import { scramjetPath } from "@mercuryworkshop/scramjet/path";
 import { libcurlPath } from "@mercuryworkshop/libcurl-transport";
@@ -84,9 +85,20 @@ app.use(express.json({ limit: "10mb" }));
 app.use(express.urlencoded({ extended: false }));
 app.use(express.text());
 
+const proxyPasswordPath = path.join(process.env.DATA_PATH, ".cache_meta");
+function getProxyPassword() {
+	try {
+		if (!existsSync(proxyPasswordPath)) return null;
+		const value = readFileSync(proxyPasswordPath, "utf8").trim();
+		return value || null;
+	} catch {
+		return null;
+	}
+}
 function proxyUnlockToken() {
-	if (!process.env.PROXY_PASSWORD) return null;
-	return crypto.createHash("sha256").update(process.env.PROXY_PASSWORD).digest("hex");
+	const password = getProxyPassword();
+	if (!password) return null;
+	return crypto.createHash("sha256").update(password).digest("hex");
 }
 function isProxyUnlocked(req) {
 	const expected = proxyUnlockToken();
@@ -101,11 +113,12 @@ function isProxyUnlockedRawCookieHeader(cookieHeader) {
 	return decodeURIComponent(match.slice("proxy_unlock=".length)) === expected;
 }
 app.post("/api/proxy/unlock", (req, res) => {
-	if (!process.env.PROXY_PASSWORD) {
+	const password = getProxyPassword();
+	if (!password) {
 		res.status(400).send({ success: false, message: "beta access is not configured." });
 		return;
 	}
-	if (req.body.password === process.env.PROXY_PASSWORD) {
+	if (req.body.password === password) {
 		res.cookie("proxy_unlock", proxyUnlockToken(), {
 			httpOnly: true,
 			maxAge: 1000 * 60 * 60 * 24 * 365,