diff --git a/server/auth.mjs b/server/auth.mjs
index 12c01a7..c8de651 100644
--- a/server/auth.mjs
+++ b/server/auth.mjs
@@ -10,8 +10,12 @@ import crypto from 'node:crypto';
 import https from 'node:https';
 
 const CLIENT_ID = () => process.env.GOOGLE_CLIENT_ID || null;
-const AUTH_SECRET = () =>
-  process.env.AUTH_SECRET || process.env.GOOGLE_CLIENT_ID || 'ihaleist-dev-secret';
+const AUTH_SECRET = () => {
+  const configured = process.env.AUTH_SECRET || process.env.GOOGLE_CLIENT_ID;
+  if (configured) return configured;
+  if (process.env.NODE_ENV === 'production') throw new Error('Üretimde AUTH_SECRET zorunludur.');
+  return 'ihaleist-dev-secret';
+};
 const TOKEN_TTL_SEC = 30 * 24 * 60 * 60; // 30 gün
 
 export function adminEmails() {