diff --git a/README.md b/README.md
index 74097d48c..ec952b321 100644
--- a/README.md
+++ b/README.md
@@ -24,10 +24,13 @@ The Talk application looks for the following configuration values either as envi
 
 - `TALK_MONGO_URL` (*required*) - the database connection string for the MongoDB database.
 - `TALK_REDIS_URL` (*required*) - the database connection string for the Redis database.
-- `TALK_SESSION_SECRET` (*required*) - a random string which will be used to
-secure cookies.
 - `TALK_ROOT_URL` (*required*) - root url of the installed application externally
 available in the format: `<scheme>://<host>` without the path.
+- `TALK_JWT_SECRET` (*required*) - a long and cryptographical secure random string which will be used to
+sign and verify tokens via a `HS256` algorithm.
+- `TALK_JWT_EXPIRY` (_optional_) - the expiry duration (`exp`) for the tokens issued for logged in sessions (Default `1 day`)
+- `TALK_JWT_ISSUER` (_optional_) - the issuer (`iss`) claim for login JWT tokens (Default `process.env.TALK_ROOT_URL`)
+- `TALK_JWT_AUDIENCE` (_optional_) - the audience (`aud`) claim for login JWT tokens (Default `talk`)
 - `TALK_SMTP_EMAIL` (*required for email*) - the address to send emails from using the
   SMTP provider.
 - `TALK_SMTP_USERNAME` (*required for email*) - username of the SMTP provider you are using.
diff --git a/services/passport.js b/services/passport.js
index a455fa745..41d57a539 100644
--- a/services/passport.js
+++ b/services/passport.js
@@ -11,7 +11,10 @@ const debug = require('debug')('talk:passport');
 
 // JWT_SECRET is the secret used to sign and verify tokens issued by this
 // application.
-const JWT_SECRET = process.env.JWT_SECRET;
+const JWT_SECRET = process.env.JWT_SECRET || null;
+if (JWT_SECRET === null) {
+  throw new Error('JWT_SECRET must be provided in the environment to sign/verify tokens');
+}
 
 // JWT_EXPIRY is the time for which a given token is valid for.
 const JWT_EXPIRY = process.env.JWT_EXPIRY || '1 day';
diff --git a/services/users.js b/services/users.js
index 14301ccf4..59cc6ba7d 100644
--- a/services/users.js
+++ b/services/users.js
@@ -22,12 +22,12 @@ const SettingsService = require('./settings');
 const ActionsService = require('./actions');
 const MailerService = require('./mailer');
 
-// In the event that the TALK_SESSION_SECRET is missing but we are testing, then
-// set the process.env.TALK_SESSION_SECRET.
-if (process.env.NODE_ENV === 'test' && !process.env.TALK_SESSION_SECRET) {
-  process.env.TALK_SESSION_SECRET = 'keyboard cat';
-} else if (!process.env.TALK_SESSION_SECRET) {
-  throw new Error('TALK_SESSION_SECRET must be defined to encode JSON Web Tokens and other auth functionality');
+// In the event that the TALK_JWT_SECRET is missing but we are testing, then
+// set the process.env.TALK_JWT_SECRET.
+if (process.env.NODE_ENV === 'test' && !process.env.TALK_JWT_SECRET) {
+  process.env.TALK_JWT_SECRET = 'keyboard cat';
+} else if (!process.env.TALK_JWT_SECRET) {
+  throw new Error('TALK_JWT_SECRET must be defined to encode JSON Web Tokens and other auth functionality');
 }
 
 const EMAIL_CONFIRM_JWT_SUBJECT = 'email_confirm';
@@ -564,7 +564,7 @@ module.exports = class UsersService {
           version: user.__v
         };
 
-        return jwt.sign(payload, process.env.TALK_SESSION_SECRET, {
+        return jwt.sign(payload, process.env.TALK_JWT_SECRET, {
           algorithm: 'HS256',
           expiresIn: '1d',
           subject: PASSWORD_RESET_JWT_SUBJECT
@@ -583,7 +583,7 @@ module.exports = class UsersService {
       // Set the allowed algorithms.
       options.algorithms = ['HS256'];
 
-      jwt.verify(token, process.env.TALK_SESSION_SECRET, options, (err, decoded) => {
+      jwt.verify(token, process.env.TALK_JWT_SECRET, options, (err, decoded) => {
         if (err) {
           return reject(err);
         }
@@ -740,7 +740,7 @@ module.exports = class UsersService {
         email,
         referer,
         userID: user.id
-      }, process.env.TALK_SESSION_SECRET, tokenOptions);
+      }, process.env.TALK_JWT_SECRET, tokenOptions);
     });
   }