diff --git a/lib/MetaCPAN/API.pm b/lib/MetaCPAN/API.pm
index 7b67a1744..62b437632 100644
--- a/lib/MetaCPAN/API.pm
+++ b/lib/MetaCPAN/API.pm
@@ -61,8 +61,9 @@ sub startup {
         );
     }
 
-    # TODO secret from config
-    $self->secrets( [ $ENV{MOJO_SECRET} ] );
+    die 'need secret' unless $self->config->{secret};
+
+    $self->secrets( [ $self->config->{secret} ] );
 
     $self->static->paths( [ $self->home->child('root') ] );
 
@@ -83,7 +84,7 @@ sub startup {
     $self->minion->add_task(
         index_favorite => $self->_gen_index_task_sub('favorite') );
 
-    $self->_maybe_set_up_routes;
+    $self->_set_up_routes;
 }
 
 sub _gen_index_task_sub {
@@ -119,17 +120,16 @@ sub _gen_index_task_sub {
         }
 }
 
-sub _maybe_set_up_routes {
+sub _set_up_routes {
     my $self = shift;
-    return unless $ENV{MOJO_SECRET} && $ENV{GITHUB_KEY};
 
     my $r = $self->routes;
 
     $self->plugin(
         'Web::Auth',
         module      => 'Github',
-        key         => $ENV{GITHUB_KEY},
-        secret      => $ENV{GITHUB_SECRET},
+        key         => $self->config->{github_key},
+        secret      => $self->config->{github_secret},
         on_finished => sub {
             my ( $c, $access_token, $account_info ) = @_;
             my $login = $account_info->{login};
diff --git a/metacpan_server_testing.conf b/metacpan_server_testing.conf
index 59e200d54..0dbc285e8 100644
--- a/metacpan_server_testing.conf
+++ b/metacpan_server_testing.conf
@@ -17,3 +17,8 @@ source_base var/t/tmp/source
     captcha_class Captcha::Mock
     private_key testing
 </controller>
+
+github_key = foo
+github_secret = bar
+
+secret weak