diff --git a/src/config.rs b/src/config.rs
index 3ca7ff7..2f32522 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -24,6 +24,8 @@ pub struct ServerConfig {
     pub max_content_length: Byte,
     /// Storage path.
     pub upload_path: PathBuf,
+    /// Authentication token.
+    pub auth_token: Option<String>,
 }
 
 /// Paste configuration.
diff --git a/src/server.rs b/src/server.rs
index 11b78f9..7b56d3e 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -89,7 +89,17 @@ async fn upload(
 ) -> Result<HttpResponse, Error> {
     let connection = request.connection_info().clone();
     let host = connection.remote_addr().unwrap_or("unknown host");
-    auth::check(host, request.headers(), env::var("AUTH_TOKEN").ok())?;
+    auth::check(
+        host,
+        request.headers(),
+        env::var("AUTH_TOKEN").ok().or(config
+            .read()
+            .map_err(|_| error::ErrorInternalServerError("cannot acquire config"))?
+            .server
+            .auth_token
+            .as_ref()
+            .cloned()),
+    )?;
     let expiry_date = header::parse_expiry_date(request.headers())?;
     let mut urls: Vec<String> = Vec::new();
     while let Some(item) = payload.next().await {