diff --git a/matrix_webhook/conf.py b/matrix_webhook/conf.py
index bb93335..6889d96 100644
--- a/matrix_webhook/conf.py
+++ b/matrix_webhook/conf.py
@@ -45,10 +45,10 @@ parser.add_argument(
 )
 parser.add_argument(
     "-k",
-    "--api-key",
-    help="shared secret to use this service. Required. Environment variable: `API_KEY`",
+    "--api-keys",
+    help="comma separated list of shared secrets to use this service. Required. Environment variable: `API_KEYS`",
     **(
-        {"default": os.environ["API_KEY"]}
+        {"default": os.environ["API_KEYS"]}
         if "API_KEY" in os.environ
         else {"required": True}
     ),
@@ -63,5 +63,5 @@ SERVER_ADDRESS = (args.host, args.port)
 MATRIX_URL = args.matrix_url
 MATRIX_ID = args.matrix_id
 MATRIX_PW = args.matrix_pw
-API_KEY = args.api_key
+API_KEYS = args.api_keys.split(",")
 VERBOSE = args.verbose
diff --git a/matrix_webhook/handler.py b/matrix_webhook/handler.py
index 2c86668..bd828fe 100644
--- a/matrix_webhook/handler.py
+++ b/matrix_webhook/handler.py
@@ -69,7 +69,7 @@ async def matrix_webhook(request):
             HTTPStatus.BAD_REQUEST, f"Missing {', '.join(missing)}"
         )
 
-    if data["key"] != conf.API_KEY:
+    if data["key"] not in conf.API_KEYS:
         return utils.create_json_response(HTTPStatus.UNAUTHORIZED, "Invalid API key")
 
     if "formatted_body" in data: