diff --git a/debian/scripts/koha-create b/debian/scripts/koha-create
index 7fba8e63b9..e416c8ccd6 100755
--- a/debian/scripts/koha-create
+++ b/debian/scripts/koha-create
@@ -105,6 +105,7 @@ generate_config_file() {
         -e "s/__END_BIBLIOS_RETRIEVAL_INFO__/`echo $END_BIBLIOS_RETRIEVAL_INFO`/g" \
         -e "s/__START_AUTHORITIES_RETRIEVAL_INFO__/`echo $START_AUTHORITIES_RETRIEVAL_INFO`/g" \
         -e "s/__END_AUTHORITIES_RETRIEVAL_INFO__/`echo $END_AUTHORITIES_RETRIEVAL_INFO`/g" \
+        -e "s/__API_SECRET__/$API_SECRET/g" \
         -e "s/__DB_NAME__/$mysqldb/g" \
         -e "s/__DB_HOST__/$mysqlhost/g" \
         -e "s/__DB_USER__/$mysqluser/g" \
@@ -403,7 +404,8 @@ DEFAULT_MEMCACHED_PREFIX="koha_"
 UPLOAD_PATH_BASE="/var/lib/koha"
 UPLOAD_DIR="uploads"
 UPLOAD_PATH=""
-
+# Generate a randomizaed API secret
+API_SECRET="$(pwgen -s 64 1)"
 # SRU server variables
 ENABLE_SRU="no"
 SRU_SERVER_PORT=""
diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in
index 8f7af30863..6bfe004b58 100644
--- a/debian/templates/koha-conf-site.xml.in
+++ b/debian/templates/koha-conf-site.xml.in
@@ -292,7 +292,10 @@ __END_SRU_PUBLICSERVER__
  <memcached_servers>__MEMCACHED_SERVERS__</memcached_servers>
  <memcached_namespace>__MEMCACHED_NAMESPACE__</memcached_namespace>
 
-<!-- true type font mapping accoding to type from $font_types in C4/Creators/Lib.pm -->
+ <!-- Secret passphrase used by Mojolicious for signed cookies -->
+ <api_secret_passphrase>__API_SECRET__</api_secret_passphrase>
+
+ <!-- true type font mapping accoding to type from $font_types in C4/Creators/Lib.pm -->
  <ttf>
     <font type="TR" >/usr/share/fonts/truetype/ttf-dejavu/DejaVuSerif.ttf</font>
     <font type="TB" >/usr/share/fonts/truetype/ttf-dejavu/DejaVuSerif-Bold.ttf</font>