diff --git a/docker-compose.yml b/docker-compose.yml
index ecdbb17..e6476bd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -34,9 +34,12 @@ services:
     environment:
       DATABASE_URL: postgresql://agendapro_user:${DB_PASSWORD}@postgres-agendapro:5432/agendapro
       JWT_SECRET_FILE: /run/secrets/jwt_secret
+      ASAAS_API_KEY_FILE: /run/secrets/asaas_api_key
+      ASAAS_ENVIRONMENT: sandbox
       NODE_ENV: production
     secrets:
       - jwt_secret
+      - asaas_api_key
     networks:
       - agendapro-internal
       - network_public
@@ -61,10 +64,13 @@ services:
       DATABASE_URL: postgresql://agendapro_user:${DB_PASSWORD}@postgres-agendapro:5432/agendapro
       JWT_SECRET_FILE: /run/secrets/jwt_secret
       ADMIN_SECRET_FILE: /run/secrets/admin_secret
+      ASAAS_API_KEY_FILE: /run/secrets/asaas_api_key
+      ASAAS_ENVIRONMENT: sandbox
       NODE_ENV: production
     secrets:
       - jwt_secret
       - admin_secret
+      - asaas_api_key
     networks:
       - agendapro-internal
       - network_public
@@ -93,3 +99,5 @@ secrets:
     external: true
   admin_secret:
     external: true
+  asaas_api_key:
+    external: true
diff --git a/src/lib/asaas.ts b/src/lib/asaas.ts
index bd8ee26..f52866b 100644
--- a/src/lib/asaas.ts
+++ b/src/lib/asaas.ts
@@ -24,8 +24,17 @@ export async function getTenantAsaasConfig(tenantId?: string): Promise<AsaasConf
     }
   }
 
+  let envApiKey = process.env.ASAAS_API_KEY;
+  if (!envApiKey && process.env.ASAAS_API_KEY_FILE) {
+    try {
+      envApiKey = require('fs').readFileSync(process.env.ASAAS_API_KEY_FILE, 'utf8').trim();
+    } catch (e) {
+      console.error('Failed to read Asaas API Key from file:', e);
+    }
+  }
+
   // Scoped API Key and Webhook Secret per tenant, with fallback to environment variables for sandbox/dev
-  const apiKey = settings.asaas_api_key || process.env.ASAAS_API_KEY;
+  const apiKey = settings.asaas_api_key || envApiKey;
   const webhookSecret = settings.asaas_webhook_secret || process.env.ASAAS_WEBHOOK_SECRET;
 
   if (!apiKey) {