diff --git a/bff/app.py b/bff/app.py
index 21ec1b2..c50744c 100644
--- a/bff/app.py
+++ b/bff/app.py
@@ -23,7 +23,7 @@ app = FastAPI(title="Team Board BFF", version="0.2.0")
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["https://team.uix.su", "http://localhost:3100"],
+    allow_origins=["https://team.uix.su", "https://dev.team.uix.su", "http://localhost:3100"],
     allow_methods=["*"],
     allow_headers=["*"],
 )
diff --git a/bff/config.py b/bff/config.py
index 279d397..58e9285 100644
--- a/bff/config.py
+++ b/bff/config.py
@@ -1,19 +1,22 @@
-"""BFF configuration."""
+"""BFF configuration — all from environment variables."""
 
 import os
 
-# Tracker (internal, not exposed to internet)
-TRACKER_URL = os.getenv("TRACKER_URL", "http://localhost:8100")
-TRACKER_WS_URL = os.getenv("TRACKER_WS_URL", "ws://localhost:8100/ws")
-TRACKER_TOKEN = os.getenv("TRACKER_TOKEN", "tb-tracker-dev-token")
+# Tracker (internal)
+TRACKER_URL = os.environ.get("TRACKER_URL", "http://localhost:8100")
+TRACKER_WS_URL = os.environ.get("TRACKER_WS_URL", "ws://localhost:8100/ws")
+TRACKER_TOKEN = os.environ["TRACKER_TOKEN"]  # required
 
 # Auth
-JWT_SECRET = os.getenv("JWT_SECRET", "tb-jwt-Kx9mP4vQ7wZn2bR5")
+JWT_SECRET = os.environ["JWT_SECRET"]  # required
 JWT_ALGORITHM = "HS256"
-AUTH_USER = os.getenv("AUTH_USER", "admin")
-AUTH_PASS = os.getenv("AUTH_PASS", "teamboard")
+AUTH_USER = os.environ.get("AUTH_USER", "admin")
+AUTH_PASS = os.environ["AUTH_PASS"]  # required
 
 # Server
-HOST = os.getenv("BFF_HOST", "0.0.0.0")
-PORT = int(os.getenv("BFF_PORT", "8200"))
-ENV = os.getenv("BFF_ENV", "dev")
+HOST = os.environ.get("BFF_HOST", "0.0.0.0")
+PORT = int(os.environ.get("BFF_PORT", "8200"))
+ENV = os.environ.get("BFF_ENV", "dev")
+
+# File storage root (for project files)
+STORAGE_ROOT = os.environ.get("STORAGE_ROOT", "/var/lib/team-board/files")
diff --git a/src/components/TaskModal.tsx b/src/components/TaskModal.tsx
index 7b66dcb..f9a505a 100644
--- a/src/components/TaskModal.tsx
+++ b/src/components/TaskModal.tsx
@@ -147,7 +147,7 @@ export default function TaskModal({ task, projectId, projectSlug, onClose, onUpd
               {title}
             </h2>
           )}
-          <div className="text-xs text-[var(--muted)] mt-1">{projectSlug.slice(0, 2).toUpperCase()}-{task.number}</div>
+          <div className="text-xs text-[var(--muted)] mt-1">{task.key}</div>
         </div>
 
         <div className="flex flex-col md:flex-row">
diff --git a/src/lib/api.ts b/src/lib/api.ts
index 3aac0c5..c5f6f90 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -79,6 +79,7 @@ export interface Task {
   project_id: string;
   parent_id: string | null;
   number: number;
+  key: string;
   title: string;
   description: string | null;
   type: string;