diff --git a/README.md b/README.md
index 59ecdf1..03c7b0b 100644
--- a/README.md
+++ b/README.md
@@ -9,9 +9,11 @@ My use case: *Connect to home server that is on a dynamic IP via a fixed domain
 
 1. Generate [Personal Access Token](https://cloud.digitalocean.com/settings/applications) from your Digital Ocean account.
 
-2. Modify the script to add `access token` and set script permission to `755`.
+2. Place the token in ~/.config/do_dns_update/access_token
 
-		chmod 755 /path/to/file/do_dns_update.sh
+3. Make script runnable.
+
+		chmod +x /path/to/file/do_dns_update.sh
 
 3. [Cron](http://en.wikipedia.org/wiki/Cron#Predefined_scheduling_definitions) the script to update Digital Ocean's DNS at desired frequency. (Note: *API rate limit is currently 1200 /hr. Script run uses 2.*)
 
@@ -41,4 +43,4 @@ My use case: *Connect to home server that is on a dynamic IP via a fixed domain
 
 ## License
 
-The MIT License (MIT).
\ No newline at end of file
+The MIT License (MIT).
diff --git a/do_dns_update.sh b/do_dns_update.sh
index 9b18f22..d41eff1 100644
--- a/do_dns_update.sh
+++ b/do_dns_update.sh
@@ -1,8 +1,9 @@
 #!/bin/bash
-# @requires awk, curl, grep, mktemp, sed, tr.
+# @requires awk, curl, grep, mktemp, sed, tr, stat.
 
-## START EDIT HERE.
-do_access_token="";  # paste your DO Personal Access Token here.
+: ${XDG_CONFIG_DIRS:=~/.config}
+
+do_access_token="${XDG_CONFIG_DIRS}"/do_dns_update/access_token
 curl_timeout="15";
 loop_max_records="50";
 url_do_api="https://api.digitalocean.com/v2";
@@ -48,11 +49,29 @@ do_domain="$2";
 if [ $# -lt 2 ] || [ -z "$do_record" ] || [ -z "$do_domain" ] ; then
   echo "Missing required arguments. (See -h for help)";
   exit 1;
-elif [ -z "$do_access_token" ] ; then
-  echo "Missing token. Please edit this script and add your access token first.";
-  exit 1;
+elif [ ! -r "$do_access_token" ]; then
+  echo "Missing token. Please paste it into $do_access_token first."
+  exit 1
+# insist on secure permissions: only the owner of the file should be able to read or write it.
+# we do a bitwise AND to mask out the g=rw and o=rw bits from the permissions;
+# if masking those out gives 0, then we're good
+# note the leading 0s! That makes these numbers octal!
+# XXX if we're concerned about writes then this also needs to check permissions on all parent directories too.
+elif [ $(($(stat -c "%#0a" $do_access_token) & 0066)) -ne 0 ]; then
+  echo "Error: $do_access_token has insecure permissions."
+  exit 1
 fi
 
+# read in access token
+strip_comments()
+{
+  sed 's/#.*//' |  # strip comments
+  sed 's/^\s*//' |    # strip leading whitespace
+  sed 's/\s*$//' |    # strip trailing whitespace
+  sed '/^$/d'  # strip empty lines -- which, after stripping leading/trailing whitespace, covers blank lines too
+}
+do_access_token="$(cat $do_access_token | strip_comments | head -n 1)";
+
 echov()
 {
   if [ $verbose == true ] ; then