diff --git a/src/main/java/eu/mhsl/craftattack/spawn/appliances/report/Report.java b/src/main/java/eu/mhsl/craftattack/spawn/appliances/report/Report.java
index 0cbd2d6..c559d04 100644
--- a/src/main/java/eu/mhsl/craftattack/spawn/appliances/report/Report.java
+++ b/src/main/java/eu/mhsl/craftattack/spawn/appliances/report/Report.java
@@ -4,6 +4,7 @@ import com.google.gson.Gson;
 import eu.mhsl.craftattack.spawn.Main;
 import eu.mhsl.craftattack.spawn.appliance.Appliance;
 import eu.mhsl.craftattack.spawn.appliance.ApplianceCommand;
+import eu.mhsl.craftattack.spawn.util.server.ApiUtil;
 import net.kyori.adventure.text.Component;
 import net.kyori.adventure.text.ComponentBuilder;
 import net.kyori.adventure.text.TextComponent;
@@ -24,7 +25,6 @@ import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.util.List;
-import java.util.Objects;
 import java.util.Optional;
 import java.util.UUID;
 
@@ -39,11 +39,11 @@ public class Report extends Appliance {
             .build();
     }
 
-    private final URI apiEndpoint;
+    private final URI apiEndpoint = ApiUtil.getReportEndpoint();
+    private final String apiSecret = ApiUtil.getApiSecret();
 
     public Report() {
         super("report");
-        this.apiEndpoint = URI.create(Objects.requireNonNull(localConfig().getString("api")));
     }
 
     private record Request(@NotNull UUID reporter, @Nullable UUID reported, String reason) {
@@ -81,6 +81,7 @@ public class Report extends Appliance {
 
     public void requestReports(Player issuer) {
         URIBuilder uriBuilder = new URIBuilder(this.apiEndpoint);
+        uriBuilder.addParameter("secret", apiSecret);
         uriBuilder.addParameter("uuid", issuer.getUniqueId().toString());
 
         try(HttpClient client = HttpClient.newHttpClient()) {
@@ -101,16 +102,19 @@ public class Report extends Appliance {
     }
 
     private void issueReport(Player issuer, Request reportRequest) {
+        URIBuilder uriBuilder = new URIBuilder(this.apiEndpoint);
+        uriBuilder.addParameter("secret", apiSecret);
+
         try(HttpClient client = HttpClient.newHttpClient()) {
             HttpRequest httpRequest = HttpRequest.newBuilder()
-                .uri(this.apiEndpoint)
+                .uri(uriBuilder.build())
                 .header("Content-Type", "application/json")
                 .POST(HttpRequest.BodyPublishers.ofString(new Gson().toJson(reportRequest)))
                 .build();
 
             HttpResponse<String> httpResponse = client.send(httpRequest, HttpResponse.BodyHandlers.ofString());
             this.printResultMessage(issuer, httpResponse);
-        } catch(IOException | InterruptedException e) {
+        } catch(IOException | InterruptedException | URISyntaxException e) {
             issuer.sendMessage(
                 Component.text("Internal server description: " + e.getMessage()).color(NamedTextColor.RED)
             );
@@ -120,6 +124,7 @@ public class Report extends Appliance {
 
     private void printReports(Player issuer, HttpResponse<String> httpResponse) {
         if(httpResponse.statusCode() != 200) {
+
             Main.logger().warning("Failed to request Reports: " + httpResponse.statusCode());
             issuer.sendMessage(
                 Component.text()
diff --git a/src/main/java/eu/mhsl/craftattack/spawn/appliances/whitelist/Whitelist.java b/src/main/java/eu/mhsl/craftattack/spawn/appliances/whitelist/Whitelist.java
index dd707fb..cbdb0d6 100644
--- a/src/main/java/eu/mhsl/craftattack/spawn/appliances/whitelist/Whitelist.java
+++ b/src/main/java/eu/mhsl/craftattack/spawn/appliances/whitelist/Whitelist.java
@@ -5,6 +5,7 @@ import eu.mhsl.craftattack.spawn.Main;
 import eu.mhsl.craftattack.spawn.api.HttpServer;
 import eu.mhsl.craftattack.spawn.appliance.Appliance;
 import eu.mhsl.craftattack.spawn.appliances.outlawed.Outlawed;
+import eu.mhsl.craftattack.spawn.util.server.ApiUtil;
 import eu.mhsl.craftattack.spawn.util.server.Floodgate;
 import eu.mhsl.craftattack.spawn.util.text.DisconnectInfo;
 import org.apache.http.client.utils.URIBuilder;
@@ -25,7 +26,6 @@ import java.time.format.DateTimeFormatter;
 import java.time.temporal.ChronoUnit;
 import java.util.Date;
 import java.util.List;
-import java.util.Objects;
 import java.util.UUID;
 import java.util.logging.Level;
 
@@ -34,7 +34,8 @@ public class Whitelist extends Appliance {
                             Long outlawed_until) {
     }
 
-    private final URI apiEndpoint = URI.create(Objects.requireNonNull(localConfig().getString("api")));
+    private final URI apiEndpoint = ApiUtil.getWhitelistEndpoint();
+    private final String apiSecret = ApiUtil.getApiSecret();
 
     public Whitelist() {
         super("whitelist");
@@ -45,37 +46,37 @@ public class Whitelist extends Appliance {
             Main.instance().getLogger().info(String.format("Running integrityCheck for %s", player.getName()));
             boolean overrideCheck = localConfig().getBoolean("overrideIntegrityCheck", false);
             UserData user = overrideCheck
-                ? new UserData(player.getUniqueId(), player.getName(), "", "", 0L, 0L)
-                : this.fetchUserData(player.getUniqueId());
+                    ? new UserData(player.getUniqueId(), player.getName(), "", "", 0L, 0L)
+                    : this.fetchUserData(player.getUniqueId());
 
-            if(timestampRelevant(user.banned_until)) {
+            if (timestampRelevant(user.banned_until)) {
                 Instant bannedDate = new Date(user.banned_until * 1000L)
-                    .toInstant()
-                    .plus(1, ChronoUnit.HOURS);
+                        .toInstant()
+                        .plus(1, ChronoUnit.HOURS);
 
                 DateTimeFormatter dateFormat = DateTimeFormatter.ofPattern("dd.MM.yyyy").withZone(ZoneOffset.UTC);
                 DateTimeFormatter timeFormat = DateTimeFormatter.ofPattern("HH:mm").withZone(ZoneOffset.UTC);
 
                 throw new DisconnectInfo.Throwable(
-                    "Du wurdest vom Server gebannt.",
-                    String.format("Dein Bann läuft am %s um %s ab!", dateFormat.format(bannedDate), timeFormat.format(bannedDate)),
-                    "Wende dich an einen Admin für weitere Informationen.",
-                    player.getUniqueId()
+                        "Du wurdest vom Server gebannt.",
+                        String.format("Dein Bann läuft am %s um %s ab!", dateFormat.format(bannedDate), timeFormat.format(bannedDate)),
+                        "Wende dich an einen Admin für weitere Informationen.",
+                        player.getUniqueId()
                 );
             }
 
             queryAppliance(Outlawed.class).updateForcedStatus(player, timestampRelevant(user.outlawed_until));
 
             String purePlayerName = Floodgate.isBedrock(player)
-                ? Floodgate.getBedrockPlayer(player).getUsername()
-                : player.getName();
+                    ? Floodgate.getBedrockPlayer(player).getUsername()
+                    : player.getName();
 
-            if(!user.username.trim().equalsIgnoreCase(purePlayerName))
+            if (!user.username.trim().equalsIgnoreCase(purePlayerName))
                 throw new DisconnectInfo.Throwable(
-                    "Nutzername geändert",
-                    String.format("Der Name '%s' stimmt nicht mit '%s' überein.", user.username, player.getName()),
-                    "Bitte kontaktiere einen Admin, um Deine Anmeldedaten zu aktualisieren!",
-                    player.getUniqueId()
+                        "Nutzername geändert",
+                        String.format("Der Name '%s' stimmt nicht mit '%s' überein.", user.username, player.getName()),
+                        "Bitte kontaktiere einen Admin, um Deine Anmeldedaten zu aktualisieren!",
+                        player.getUniqueId()
                 );
 
         } catch(DisconnectInfo.Throwable e) {
@@ -98,6 +99,7 @@ public class Whitelist extends Appliance {
 
     private UserData fetchUserData(UUID uuid) throws DisconnectInfo.Throwable {
         URIBuilder uriBuilder = new URIBuilder(apiEndpoint);
+        uriBuilder.addParameter("secret", this.apiSecret);
         uriBuilder.addParameter("uuid", uuid.toString());
 
         try(HttpClient client = HttpClient.newHttpClient()) {
diff --git a/src/main/java/eu/mhsl/craftattack/spawn/util/server/ApiUtil.java b/src/main/java/eu/mhsl/craftattack/spawn/util/server/ApiUtil.java
new file mode 100644
index 0000000..bc3f697
--- /dev/null
+++ b/src/main/java/eu/mhsl/craftattack/spawn/util/server/ApiUtil.java
@@ -0,0 +1,43 @@
+package eu.mhsl.craftattack.spawn.util.server;
+
+import eu.mhsl.craftattack.spawn.config.Configuration;
+
+import java.net.URI;
+import java.util.Objects;
+
+public class ApiUtil {
+    private static URI whitelistEndpoint;
+    private static URI reportEndpoint;
+    private static String baseUrl;
+    private static String apiSecret;
+
+    public static String getApiSecret() {
+        if(apiSecret == null) {
+            apiSecret = Objects.requireNonNull(Configuration.cfg.getConfigurationSection("api")).getString("secret");
+        }
+        return apiSecret;
+    }
+
+    public static String getBaseUrl() {
+        if(baseUrl == null) {
+            baseUrl = Objects.requireNonNull(Configuration.cfg.getConfigurationSection("api")).getString("baseurl");
+        }
+        return baseUrl;
+    }
+
+    public static URI getWhitelistEndpoint() {
+        if(whitelistEndpoint == null) {
+            String configValue = Objects.requireNonNull(Configuration.cfg.getConfigurationSection("api")).getString("whitelist");
+            whitelistEndpoint = URI.create(getBaseUrl() + Objects.requireNonNull(configValue));
+        }
+        return whitelistEndpoint;
+    }
+
+    public static URI getReportEndpoint() {
+        if(reportEndpoint == null) {
+            String configValue = Objects.requireNonNull(Configuration.cfg.getConfigurationSection("api")).getString("report");
+            reportEndpoint = URI.create(getBaseUrl() + Objects.requireNonNull(configValue));
+        }
+        return reportEndpoint;
+    }
+}
diff --git a/src/main/resources/config.yml b/src/main/resources/config.yml
index 476f32b..95a0324 100644
--- a/src/main/resources/config.yml
+++ b/src/main/resources/config.yml
@@ -2,6 +2,12 @@ plugin:
   disabledAppliances:
     - NameOfApplianceClass
 
+api:
+  secret: qeeDmIXn@Wfye4@f8twTJkdNWr7Uz2byETKJBE9bfxz&M7VqOnuA3q3GT#WkwTVn
+  baseurl: https://mhsl.eu/craftattack/api/
+  report: report
+  whitelist: user
+
 worldMuseum:
   uuid:
   connect-server-name: worldmuseum
@@ -24,9 +30,6 @@ countdown:
   worldborder-before: 37
   worldborder-after: 0
 
-report:
-  api: https://mhsl.eu/craftattack/api/report
-
 event:
   api: http://10.20.6.5:8080/
   connect-server-name: event
@@ -50,7 +53,6 @@ playerLimit:
 
 whitelist:
   overrideIntegrityCheck: false
-  api: https://mhsl.eu/craftattack/api/user
 
 tablist:
   interface: eth0