diff --git a/mcp-server/src/legal_mcp/services/http_auth.py b/mcp-server/src/legal_mcp/services/http_auth.py
index d843f46..d530a3e 100644
--- a/mcp-server/src/legal_mcp/services/http_auth.py
+++ b/mcp-server/src/legal_mcp/services/http_auth.py
@@ -38,9 +38,14 @@ from mcp.server.auth.provider import AccessToken, TokenVerifier
 
 logger = logging.getLogger("legal_mcp.http_auth")
 
-#: Environment variable carrying the shared bearer token. Populated from
-#: Infisical by the service unit — see docs/spec/X10-deploy-env-secrets.md.
-TOKEN_ENV = "MCP_HTTP_TOKEN"
+#: Environment variable carrying the shared bearer token.
+#:
+#: Name matches the Infisical key exactly — All Infrastructure / env `main` /
+#: `/apps/legal-ai` / ``MCP_HTTP_SHARED_SECRET``, tagged ``credentials``. Keeping
+#: the two identical means nobody has to hold a mapping in their head, and it
+#: follows the two bridge tokens already in that folder
+#: (``COURT_FETCH_SHARED_SECRET``, ``LEGAL_CHAT_SHARED_SECRET``).
+TOKEN_ENV = "MCP_HTTP_SHARED_SECRET"
 
 #: Minimum acceptable token length. Short tokens are brute-forceable; refusing
 #: them at startup is cheaper than discovering it from an access log.