diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4ce3a50
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+docker-compose-server.yml
\ No newline at end of file
diff --git a/go_cloud/bin/api b/go_cloud/bin/api
index f5c6d35..cc9e7cd 100755
Binary files a/go_cloud/bin/api and b/go_cloud/bin/api differ
diff --git a/go_cloud/internal/http/wopi_handlers.go b/go_cloud/internal/http/wopi_handlers.go
index b90c9b2..279bdb2 100644
--- a/go_cloud/internal/http/wopi_handlers.go
+++ b/go_cloud/internal/http/wopi_handlers.go
@@ -662,8 +662,8 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database.
 		return
 	}
 
-	// Build WOPISrc URL
-	wopiSrc := fmt.Sprintf("https://go.b0esche.cloud/wopi/files/%s?access_token=%s", fileID, accessToken)
+	// Build WOPISrc URL (without access_token - that goes in a separate form field)
+	wopiSrc := fmt.Sprintf("https://go.b0esche.cloud/wopi/files/%s", fileID)
 
 	// Return HTML page with auto-submitting form
 	// The form POSTs to Collabora from within an iframe to work around CSP frame-ancestors restrictions
@@ -686,19 +686,20 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database.
   </div>
   <form method="POST" action="%s/browser/dist/cool.html" target="_self" id="collaboraForm" style="display: none;">
     <input type="hidden" name="WOPISrc" value="%s">
+    <input type="hidden" name="access_token" value="%s">
   </form>
   <script>
     // Auto-submit the form to Collabora
     var form = document.getElementById('collaboraForm');
     if (form) {
-      console.log('[COLLABORA] Submitting form to /browser/dist/cool.html with WOPISrc');
+      console.log('[COLLABORA] Submitting form to /browser/dist/cool.html');
       form.submit();
     } else {
       console.error('[COLLABORA] Form not found');
     }
   </script>
 </body>
-</html>`, collaboraURL, wopiSrc)
+</html>`, collaboraURL, wopiSrc, accessToken)
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	// Don't set X-Frame-Options - this endpoint is meant to be loaded in an iframe