diff --git a/README.md b/README.md
index 942ee6c..5ed8bd4 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 a minimal, smooth file transfer service with 10-minute auto-deletion.
 
-> **Note**: This repository uses a placeholder backend URL (`https://YOUR_BACKEND_URL.trycloudflare.com`) and placeholder API key (`YOUR_API_KEY_HERE`) so no private endpoints or keys are exposed publicly.
+> **Note**: This repository uses a placeholder backend URL (`https://YOUR_BACKEND_URL.trycloudflare.com`) so no private endpoints are exposed publicly.
 
 ## features
 
@@ -12,30 +12,19 @@ a minimal, smooth file transfer service with 10-minute auto-deletion.
 - drag & drop files anywhere to upload instantly
 - 10-minute auto-deletion timer per file with live countdown
 - safe path verification and collision-free file naming
-- optional API key authorization (`x-katdrop-key`)
 - zero external CDN dependencies (works completely offline)
 
 ## configuration
 
 ### connecting your frontend to your backend
 
-To connect your deployed frontend to your private backend (e.g. Cloudflare Tunnel or local server), pass your API URL and optional key via URL parameters once:
+To connect your deployed frontend to your private backend (e.g. Cloudflare Tunnel or local server), pass your API URL via URL parameters once:
 
 ```
-https://your-site.netlify.app/?api=https://your-tunnel.trycloudflare.com&key=YOUR_SECRET_KEY
+https://katdrop.oiupoyt.space/?api=https://your-tunnel.trycloudflare.com
 ```
 
-KatDrop will automatically save these to `localStorage` in your browser.
-
-### backend API key (optional)
-
-To require an API key on your backend, set `KATDROP_KEY`:
-
-```bash
-KATDROP_KEY=mysecretkey npm start
-```
-
-If not set, the backend runs without key verification.
+katdrop will automatically save this to `localStorage` in your browser.
 
 ## usage
 
diff --git a/public/js/app.js b/public/js/app.js
index 2d0ed95..dd4b490 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -20,26 +20,19 @@
 
   let selectedFiles = [];
 
-  // API & Key Configuration (configurable via URL param ?api=...&key=... or localStorage)
-  const DEFAULT_REMOTE_API = 'https://feof-signals-fix-chevy.trycloudflare.com';
+  // API Configuration (configurable via URL param ?api=... or localStorage)
+  // Public repo uses placeholder values for security
+  const DEFAULT_REMOTE_API = 'https://YOUR_BACKEND_URL.trycloudflare.com';
   const urlParams = new URLSearchParams(window.location.search);
   if (urlParams.has('api')) {
     const customApi = urlParams.get('api').replace(/\/+$/, '');
     localStorage.setItem('katdrop_api', customApi);
   }
-  if (urlParams.has('key')) {
-    localStorage.setItem('katdrop_key', urlParams.get('key'));
-  }
   const isLocalOrigin = window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1' || window.location.hostname.startsWith('192.168.');
   const API_BASE = window.KATDROP_API || localStorage.getItem('katdrop_api') || (isLocalOrigin ? '' : DEFAULT_REMOTE_API);
-  const API_KEY = window.KATDROP_KEY || localStorage.getItem('katdrop_key') || 'YOUR_API_KEY_HERE';
 
-  // Authenticated fetch helper
+  // Fetch helper
   function apiFetch(url, options = {}) {
-    options.headers = options.headers || {};
-    if (API_KEY && API_KEY !== 'YOUR_API_KEY_HERE') {
-      options.headers['x-katdrop-key'] = API_KEY;
-    }
     return fetch(url, options);
   }
 
@@ -301,8 +294,6 @@
         const size = typeof file === 'object' && file.sizeFormatted ? file.sizeFormatted : '';
         const expiresMs = file.expiresAt ? new Date(file.expiresAt).getTime() : (Date.now() + 600000);
         const remainingSec = Math.max(0, Math.ceil((expiresMs - Date.now()) / 1000));
-        const keyParam = (API_KEY && API_KEY !== 'YOUR_API_KEY_HERE') ? `?key=${encodeURIComponent(API_KEY)}` : '';
-
         li.innerHTML = `
           <div class="file-info">
             <span class="file-name" title="${escapeHtml(name)}">${escapeHtml(name)}</span>
@@ -312,7 +303,7 @@
             </div>
           </div>
           <div class="file-actions">
-            <a href="${API_BASE}/uploads/${encodeURIComponent(name)}${keyParam}" class="action-btn action-download" download>download</a>
+            <a href="${API_BASE}/uploads/${encodeURIComponent(name)}" class="action-btn action-download" download>download</a>
             <button class="action-btn action-delete" onclick="deleteFile('${escapeHtml(name)}', this.closest('li'))">delete</button>
           </div>
         `;
@@ -411,9 +402,6 @@
     };
 
     xhr.open('POST', `${API_BASE}/upload`);
-    if (API_KEY && API_KEY !== 'YOUR_API_KEY_HERE') {
-      xhr.setRequestHeader('x-katdrop-key', API_KEY);
-    }
     xhr.send(formData);
   }
 
diff --git a/server.js b/server.js
index 0f1e083..011e583 100644
--- a/server.js
+++ b/server.js
@@ -95,7 +95,7 @@ const upload = multer({
 app.use((req, res, next) => {
   res.header('Access-Control-Allow-Origin', '*');
   res.header('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, x-katdrop-key');
+  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
   if (req.method === 'OPTIONS') {
     return res.sendStatus(200);
   }
@@ -104,19 +104,6 @@ app.use((req, res, next) => {
 app.use(express.json());
 app.use(express.static(publicDir));
 
-// Optional API Key Protection (if KATDROP_KEY environment variable is set)
-const REQUIRED_API_KEY = process.env.KATDROP_KEY || '';
-if (REQUIRED_API_KEY) {
-  app.use((req, res, next) => {
-    if (req.method === 'OPTIONS' || req.path === '/health' || req.path === '/') return next();
-    const clientKey = req.headers['x-katdrop-key'] || req.query.key;
-    if (clientKey !== REQUIRED_API_KEY) {
-      return res.status(401).json({ error: 'Unauthorized: Invalid or missing API key' });
-    }
-    next();
-  });
-}
-
 // Health check endpoint
 app.get('/health', (req, res) => {
   res.json({ status: 'ok', uptime: Math.floor(process.uptime()) });
diff --git a/uploads/.gitkeep b/uploads/.gitkeep
index 2b63067..ee46bce 100644
--- a/uploads/.gitkeep
+++ b/uploads/.gitkeep
@@ -1 +1 @@
-# KatDrop uploads directory
+# katdrop uploads directory