diff --git a/jlrpy.py b/jlrpy.py
index 5e7832b..d89cdb7 100755
--- a/jlrpy.py
+++ b/jlrpy.py
@@ -1,6 +1,8 @@
 """ Simple Python class to access the JLR Remote Car API
 https://github.com/ardevd/jlrpy
 """
+import os
+import warnings
 
 
 import calendar
@@ -72,6 +74,12 @@ def __init__(self,
                 "grant_type": "refresh_token",
                 "refresh_token": refresh_token}
         else:
+            warnings.warn(
+                "Password grant (ROPC) is deprecated per RFC 9700. "
+                "Use refresh_token authentication instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
             self.oauth = {
                 "grant_type": "password",
                 "username": email,
@@ -153,7 +161,7 @@ def _set_header(self, access_token):
             "X-Device-Id": self.device_id,
             "x-telematicsprogramtype": "jlrpy",
             "x-App-Id": "ICR_JAGUAR_ANDROID",
-            "x-App-Secret": "7bf6f544-1926-4714-8066-ceceb40d538d",
+            "x-App-Secret": os.environ.get("JLR_APP_SECRET", "7bf6f544-1926-4714-8066-ceceb40d538d"),
             "Content-Type": "application/json"}
 
     def _authenticate(self, data=None):