diff --git a/scripts/install b/scripts/install
index aa6d052..8b4df53 100755
--- a/scripts/install
+++ b/scripts/install
@@ -199,6 +199,7 @@ ynh_replace_string --match_string="__DB_NAME__" --replace_string="$db_name" --ta
 ynh_replace_string --match_string="__DB_USER__" --replace_string="$db_user" --target_file="$final_path/.env"
 ynh_replace_string --match_string="__DB_PASS__" --replace_string="$db_pwd" --target_file="$final_path/.env"
 
+ynh_replace_string --match_string="__API_SECRET__" --replace_string="$(ynh_string_random --length=32)" --target_file="$final_path/.env"
 ynh_replace_string --match_string="__APP_KEY__" --replace_string="$(ynh_string_random --length=32)" --target_file="$final_path/.env"
 ynh_replace_string --match_string="__PHANTOMJS_KEY__" --replace_string="$(ynh_string_random --length=32)" --target_file="$final_path/.env"
 
diff --git a/sources/extra_files/app/.env b/sources/extra_files/app/.env
index ebf2628..f0d5eda 100644
--- a/sources/extra_files/app/.env
+++ b/sources/extra_files/app/.env
@@ -4,6 +4,10 @@ APP_LOCALE=__LANGUAGE__
 APP_URL=https://__DOMAIN____PATH__/index.php
 APP_KEY=__APP_KEY__
 APP_CIPHER=AES-256-CBC
+
+# used to connect with the mobile app
+API_SECRET=__API_SECRET__
+
 REQUIRE_HTTPS=true
 DB_TYPE=mysql
 DB_HOST=localhost