diff --git a/test/orderBookingsPost.http b/test/orderBookingsPost.http
index b4f0d4f3..83d7fba2 100644
--- a/test/orderBookingsPost.http
+++ b/test/orderBookingsPost.http
@@ -1,3 +1,6 @@
+# Local testing template only. Fill placeholders with non-production credentials from local env/secrets.
+# Never commit real API tokens, setup tokens, emails, or passwords.
+
 ### POST request to /account/auth/phone
 POST https://api.truckwash.dk:4433/account/auth/phone
 Accept: application/json
@@ -12,7 +15,7 @@ Content-Type: application/json
 POST https://api.truckwash.dk:4433/subusers
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
     "cvr": 41004355,
@@ -93,10 +96,10 @@ Authorization: Bearer {{$API_TRUCKWASH_TOKEN}}
 Content-Type: application/json
 
 ### GET request to /subusers/setup
-GET https://api.truckwash.dk:4433/subusers/setup?token=1c1be8280bac3937487e5c77b76bb839
+GET https://api.truckwash.dk:4433/subusers/setup?token={{SUBUSER_SETUP_TOKEN}}
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### POST /bird/voice/calls/webhook/inbound
 POST http://localhost/bird/voice/calls/webhook/inbound
@@ -107,7 +110,7 @@ content-type: application/json
     "service": "channels",
     "event": "voice.inbound",
     "url": "https://yoururl.com",
-    "signingKey": "mysecretkey",
+    "signingKey": "{{BIRD_SIGNING_KEY}}",
     "eventFilters": [
         {
             "key": "channelId",
@@ -129,14 +132,14 @@ content-type: application/json
 POST http://localhost/api/subusers/setup
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
-    "token": "1c1be8280bac3937487e5c77b76bb839",
+    "token": "{{SUBUSER_SETUP_TOKEN}}",
     "name": "Test Subuser",
     "username": "testsubuser",
-    "email": "jb@truckwash.dk",
-    "password": "Test1234"
+    "email": "{{SUBUSER_EMAIL}}",
+    "password": "{{SUBUSER_PASSWORD}}"
 }
 
 ### POST request to /subusers/auth/password
@@ -146,42 +149,42 @@ Content-Type: application/json
 
 {
     "username": "testsubuser",
-    "password": "Test1234"
+    "password": "{{SUBUSER_PASSWORD}}"
 }
 
 ### GET request to /order-bookings (As subuser)
 GET https://api.truckwash.dk:4433/order-bookings
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /order-bookings (As subuser, specific ID)
 GET https://api.truckwash.dk:4433/order-bookings?id=76
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /vehicles (As subuser)
 GET https://api.truckwash.dk:4433/vehicles
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /vehicles (As subuser, specific ID)
 GET https://api.truckwash.dk:4433/vehicles?id=384
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /orders (As subuser)
 GET https://api.truckwash.dk:4433/orders
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 
@@ -189,46 +192,46 @@ X-Customer-Number: 42331128
 GET https://api.truckwash.dk:4433/subusers/me
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /subusers/permission-nodes
 GET https://api.truckwash.dk:4433/subusers/permission-nodes
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### GET request to /subusers/grants (As subuser)
 GET https://api.truckwash.dk:4433/subusers/grants
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to order bookings (list all)
 GET https://api.truckwash.dk:4433/order-bookings
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### GET request to order bookings (specific ID)
 GET https://api.truckwash.dk:4433/order-bookings?id=1
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 
 ### GET request to weather (specific ID)
 GET https://api.truckwash.io/departments/weather?id=1
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### PUT request to order bookings (update specific ID)
 PUT https://api.truckwash.dk:4433/order-bookings
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
     "id": 4,
@@ -241,7 +244,7 @@ Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb206
 POST https://api.truckwash.dk:4433/order-bookings/complete
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
     "id": 3,
@@ -260,7 +263,7 @@ Content-Type: application/json
 ### Get department distribution e-conomic
 GET http://localhost/api/superuser/invoicing/period/distribution/v2/booked-department-75
 Accept: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 Content-Type: application/json
 
 {
@@ -273,7 +276,7 @@ Content-Type: application/json
 POST https://api.truckwash.dk:4433/order-bookings
 Accept: application/json, text/plain, */*
 Accept-Language: en-GB,en;q=0.6
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 Content-Type: application/json
 
 {