diff --git a/conf/default.env b/conf/default.env
index 825ca6d..54f36d3 100644
--- a/conf/default.env
+++ b/conf/default.env
@@ -57,7 +57,8 @@ PHANTOMJS_KEY='__PHANTOMJS_KEY__'
 PHANTOMJS_SECRET=__APP_KEY__
 
 UPDATE_SECRET=__API_SECRET__
-API_SECRET=__API_SECRET__
+# API_SECRET is intentionally not set: when set, it requires the X-API-SECRET header
+# on ALL API calls including the web UI login (React SPA), which breaks browser login.
 
 PRECONFIGURED_INSTALL=true