diff --git a/Dockerfile b/Dockerfile
index a44101b..1982141 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,5 +14,6 @@ COPY . /usr/src/app
 WORKDIR /usr/src/app/server
 RUN python manage.py migrate
 EXPOSE 8000
-
-CMD ["python", "-u", "manage.py", "runserver", "0.0.0.0:8000"]
+ENV DEBUG=False
+ENV SECRET_KEY='xx'
+CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
diff --git a/README.md b/README.md
index a6d7f6e..6e77750 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,11 @@ You can create a superuser with `./manage.py createsuperuser` to be able to acce
 ## Usage
 You can navigate the API using the url `http://myserver.com/docs/` (Swagger based OpenAPI documentation, default on localhost:8000).
 
+## ENVS
+
+- DEBUG = False  (if we should enable debug mode in django)
+- SECRET_KEY = secret key for django
+
 # Dockerfile usage
 You can also just build the available Dockerfile and run the server from there using the following commands:
 
@@ -50,5 +55,5 @@ Thanks to the $OCEAN community for the funding and the $OCEAN core team for the
 This project is delivered under an Apache License
 
 ## Additional projects
- - DBS Arweave microservice (https://github.com/oceanprotocol/dbs_filecoin)
- - DBS Filecoin microservice (https://github.com/oceanprotocol/dbs_arweave)
+ - DBS Filecoin microservice (https://github.com/oceanprotocol/dbs_filecoin)
+ - DBS Arweave microservice (https://github.com/oceanprotocol/dbs_arweave)
diff --git a/server/server/settings.py b/server/server/settings.py
index 88ca6ce..9ae7ce8 100644
--- a/server/server/settings.py
+++ b/server/server/settings.py
@@ -25,13 +25,12 @@
 # See https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = '6e_qi$a_w5rni$dl)!r-xq-h*=da6q3#4gs4k3%+p(bd42yrv+'
+SECRET_KEY = os.environ.get("SECRET_KEY")
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
-PYTHONUNBUFFERED = True
+DEBUG = os.environ.get("DEBUG",False)
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS = ['*']
 
 
 # Application definition