diff --git a/server/auth.mjs b/server/auth.mjs
index c8de651..074099e 100644
--- a/server/auth.mjs
+++ b/server/auth.mjs
@@ -44,7 +44,9 @@ export function signToken(payload) {
 export function verifyToken(token) {
   if (!token || typeof token !== 'string' || !token.includes('.')) return null;
   const [data, sig] = token.split('.');
-  const expected = b64url(crypto.createHmac('sha256', AUTH_SECRET()).update(data).digest());
+  let secret;
+  try { secret = AUTH_SECRET(); } catch { return null; }
+  const expected = b64url(crypto.createHmac('sha256', secret).update(data).digest());
   if (
     sig.length !== expected.length ||
     !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))