diff --git a/docs/mods-and-plugins/curseforge-files.md b/docs/mods-and-plugins/curseforge-files.md
index f0d64f29..886802de 100644
--- a/docs/mods-and-plugins/curseforge-files.md
+++ b/docs/mods-and-plugins/curseforge-files.md
@@ -6,7 +6,7 @@ A specific file can be omitted from each reference to allow for auto-selecting t
 
 !!! warning "CurseForge API key usage"
 
-    A CurseForge API key must be allocated and set with `CF_API_KEY` [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).
+    A CurseForge API key must be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).
 
 ## Project-file references
 
diff --git a/docs/types-and-platforms/mod-platforms/auto-curseforge.md b/docs/types-and-platforms/mod-platforms/auto-curseforge.md
index 3bbb0fea..acfaa87a 100644
--- a/docs/types-and-platforms/mod-platforms/auto-curseforge.md
+++ b/docs/types-and-platforms/mod-platforms/auto-curseforge.md
@@ -32,6 +32,20 @@ To manage a CurseForge modpack automatically with upgrade support, pinned or lat
     docker run --env-file=.env itzg/minecraft-server
     ```
 
+    Alternately you can use [docker secrets](https://docs.docker.com/compose/how-tos/use-secrets/) with a `CF_API_KEY_FILE` environment variable:
+    ```
+    service:
+      environment:
+        CF_API_KEY_FILE: /run/secrets/cf_api_key
+      secrets:
+        - cf_api_key
+
+    secrets:
+      cf_api_key:
+        file: cf_api_key.secret
+    ```
+
+
 !!! note
     Be sure to use the appropriate [image tag for the Java version compatible with the modpack](../../versions/java.md).
     
diff --git a/docs/variables.md b/docs/variables.md
index eaed4fb6..1f4928e8 100644
--- a/docs/variables.md
+++ b/docs/variables.md
@@ -730,6 +730,12 @@ alternatively, you can mount: <code>/etc/localtime:/etc/localtime:ro
             <td><code></code></td>
             <td>✅</td>
         </tr>
+        <tr>
+            <td><code>CF_API_KEY_FILE</code></td>
+            <td>A path to a file inside of container that contains <strong>YOUR</strong> CurseForge (Eternal) API Key.</td>
+            <td><code></code></td>
+            <td>✅</td>
+        </tr>        
         <tr>
             <td><code>CF_PAGE_URL</code></td>
             <td>Pass a page URL to the modpack or a specific file</td>
diff --git a/scripts/start-deployAutoCF b/scripts/start-deployAutoCF
index e4b9870d..e2dc10e2 100644
--- a/scripts/start-deployAutoCF
+++ b/scripts/start-deployAutoCF
@@ -21,9 +21,20 @@ set -eu
 : "${CF_DOWNLOADS_REPO=$([ -d /downloads ] && echo '/downloads' || echo '')}"
 : "${CF_MODPACK_MANIFEST:=}"
 : "${CF_API_CACHE_DEFAULT_TTL:=}" # as ISO-8601 duration, such as P2D or PT12H
+: "${CF_API_KEY_FILE:=}" # Path to file containing CurseForge API key
 
 resultsFile=/data/.install-curseforge.env
 
+if [[ -n ${CF_API_KEY_FILE} ]]; then
+  if [[ -r "${CF_API_KEY_FILE}" ]]; then
+    CF_API_KEY="$(cat "${CF_API_KEY_FILE}")"
+    export CF_API_KEY
+  else
+    logError "CF_API_KEY_FILE is not readable: ${CF_API_KEY_FILE}"
+    exit 1
+  fi
+fi
+
 isDebugging && set -x
 
 ensureRemoveAllModsOff "MODPACK_PLATFORM=AUTO_CURSEFORGE"
diff --git a/scripts/start-setupModpack b/scripts/start-setupModpack
index 7109330b..ea52d135 100755
--- a/scripts/start-setupModpack
+++ b/scripts/start-setupModpack
@@ -11,8 +11,19 @@ set -e -o pipefail
 : "${PLUGINS_FILE:=}"
 : "${REMOVE_OLD_MODS_DEPTH:=1} "
 : "${REMOVE_OLD_MODS_INCLUDE:=*.jar,*-version.json}"
+: "${CF_API_KEY_FILE:=}" # Path to file containing CurseForge API key
 sum_file=/data/.generic_pack.sum
 
+if [[ -n ${CF_API_KEY_FILE} ]]; then
+  if [[ -r "${CF_API_KEY_FILE}" ]]; then
+    CF_API_KEY="$(cat "${CF_API_KEY_FILE}")"
+    export CF_API_KEY
+  else
+    logError "CF_API_KEY_FILE is not readable: ${CF_API_KEY_FILE}"
+    exit 1
+  fi
+fi
+
 # shellcheck source=start-utils
 . "${SCRIPTS:-/}start-utils"
 isDebugging && set -x
diff --git a/tests/.gitignore b/tests/.gitignore
index adbb97d2..08d75645 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -1 +1,2 @@
-data/
\ No newline at end of file
+data/
+cf_api_key.secret
\ No newline at end of file
diff --git a/tests/setuponlytests/auto_curseforge_file/docker-compose.yml b/tests/setuponlytests/auto_curseforge_file/docker-compose.yml
new file mode 100644
index 00000000..cee473b1
--- /dev/null
+++ b/tests/setuponlytests/auto_curseforge_file/docker-compose.yml
@@ -0,0 +1,18 @@
+services:
+  mc:
+    image: ${IMAGE_TO_TEST:-itzg/minecraft-server}
+    environment:
+      EULA: "true"
+      SETUP_ONLY: "TRUE"
+      MODPACK_PLATFORM: AUTO_CURSEFORGE
+      CF_API_KEY_FILE: /run/secrets/cf_api_key
+      CF_PAGE_URL: https://www.curseforge.com/minecraft/modpacks/the-pixelmon-modpack/files/5954570
+      DEBUG: true
+    volumes:
+      - ./data:/data
+    secrets:
+      - cf_api_key
+secrets:
+  cf_api_key:
+    file: cf_api_key.secret
+
diff --git a/tests/setuponlytests/auto_curseforge_file/require.sh b/tests/setuponlytests/auto_curseforge_file/require.sh
new file mode 100755
index 00000000..871fec0f
--- /dev/null
+++ b/tests/setuponlytests/auto_curseforge_file/require.sh
@@ -0,0 +1,2 @@
+[[ -n "$CF_API_KEY" ]] || exit 1
+echo "$CF_API_KEY" > cf_api_key.secret || exit 1
\ No newline at end of file
diff --git a/tests/setuponlytests/auto_curseforge_file/verify.sh b/tests/setuponlytests/auto_curseforge_file/verify.sh
new file mode 100644
index 00000000..950cdde9
--- /dev/null
+++ b/tests/setuponlytests/auto_curseforge_file/verify.sh
@@ -0,0 +1,2 @@
+mc-image-helper assert fileExists "/data/mods/ExplorersCompass-1.16.5-1.1.2-forge.jar"
+mc-image-helper assert fileExists "/data/forge-1.16.5-36.2.34.jar"