diff --git a/management/auth.py b/management/auth.py
index 0a88c457..f46f5a05 100644
--- a/management/auth.py
+++ b/management/auth.py
@@ -22,20 +22,20 @@ class AuthService:
 	def init_system_api_key(self):
 		"""Write an API key to a local file so local processes can use the API"""
 
-		def create_file_with_mode(path, mode):
-			# Based on answer by A-B-B: http://stackoverflow.com/a/15015748
-			old_umask = os.umask(0)
-			try:
-				return os.fdopen(os.open(path, os.O_WRONLY | os.O_CREAT, mode), 'w')
-			finally:
-				os.umask(old_umask)
+		# def create_file_with_mode(path, mode):
+		# 	# Based on answer by A-B-B: http://stackoverflow.com/a/15015748
+		# 	old_umask = os.umask(0)
+		# 	try:
+		# 		return os.fdopen(os.open(path, os.O_WRONLY | os.O_CREAT, mode), 'w')
+		# 	finally:
+		# 		os.umask(old_umask)
 
-		self.key = secrets.token_hex(32)
+		# self.key = secrets.token_hex(32)
 
-		os.makedirs(os.path.dirname(self.key_path), exist_ok=True)
+		# os.makedirs(os.path.dirname(self.key_path), exist_ok=True)
 
-		with create_file_with_mode(self.key_path, 0o640) as key_file:
-			key_file.write(self.key + '\n')
+		# with create_file_with_mode(self.key_path, 0o640) as key_file:
+		# 	key_file.write(self.key + '\n')
 
 	def authenticate(self, request, env, login_only=False, logout=False):
 		"""Test if the HTTP Authorization header's username matches the system key, a session key,
diff --git a/setup/management.sh b/setup/management.sh
index 910d8d05..fb76b7d2 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -98,9 +98,12 @@ export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
 export LC_TYPE=en_US.UTF-8
 
+mkdir -p /var/lib/mailinabox
+{ tr -cd '[:xdigit:]' < /dev/urandom | head -c 32 } > /var/lib/mailinabox/api.key
+
 source $venv/bin/activate
 export PYTHONPATH=$(pwd)/management
-exec gunicorn -b localhost:10222 -w 1 wsgi:app
+exec gunicorn -b localhost:10222 -w 2 wsgi:app
 EOF
 chmod +x $inst_dir/start
 cp --remove-destination conf/mailinabox.service /lib/systemd/system/mailinabox.service # target was previously a symlink so remove it first