diff --git a/golink.go b/golink.go
index 3bc3353..fb0e791 100644
--- a/golink.go
+++ b/golink.go
@@ -37,6 +37,7 @@ var (
 	sqlitefile = flag.String("sqlitedb", "", "path of SQLite database to store links")
 	dev        = flag.String("dev-listen", "", "if non-empty, listen on this addr and run in dev mode; auto-set sqlitedb if empty and don't use tsnet")
 	snapshot   = flag.String("snapshot", "", "file path of snapshot file")
+	keyfile    = flag.String("keyfile", "", "file path of file containing tskey")
 )
 
 var stats struct {
@@ -116,6 +117,13 @@ func Run() error {
 		Hostname: "go",
 		Logf:     func(format string, args ...any) {},
 	}
+	if *keyfile != "" {
+		keyData, err := os.ReadFile(*keyfile)
+		if err != nil {
+			log.Fatalf("error reading keyfile file %q: %v", *keyfile, err)
+		}
+		srv.AuthKey = string(keyData)
+	}
 	if *verbose {
 		srv.Logf = log.Printf
 	}
@@ -353,7 +361,7 @@ type expandEnv struct {
 var expandFuncMap = texttemplate.FuncMap{
 	"PathEscape":  url.PathEscape,
 	"QueryEscape": url.QueryEscape,
-	"TrimSuffix": strings.TrimSuffix,
+	"TrimSuffix":  strings.TrimSuffix,
 }
 
 // expandLink returns the expanded long URL to redirect to, executing any