diff --git a/server/src/auth/auth.ts b/server/src/auth/auth.ts
index 0fbfe7c..ceed746 100644
--- a/server/src/auth/auth.ts
+++ b/server/src/auth/auth.ts
@@ -31,7 +31,13 @@ async function generateAppleClientSecret(): Promise<string> {
 
   // Resolve relative to the server/ directory (where the process runs from).
   const absolutePath = resolve(process.cwd(), keyPath);
-  const pem = readFileSync(absolutePath, 'utf8');
+  let pem: string;
+  try {
+    pem = readFileSync(absolutePath, 'utf8');
+  } catch {
+    console.warn(`[auth] Apple private key not found at ${absolutePath}. Web Sign in with Apple disabled.`);
+    return '';
+  }
   const privateKey = await importPKCS8(pem, 'ES256');
 
   return await new SignJWT({})