diff --git a/server/src/main/kotlin/moe/lava/banksia/server/Application.kt b/server/src/main/kotlin/moe/lava/banksia/server/Application.kt
index 07901df..0c401ae 100644
--- a/server/src/main/kotlin/moe/lava/banksia/server/Application.kt
+++ b/server/src/main/kotlin/moe/lava/banksia/server/Application.kt
@@ -16,6 +16,7 @@ import io.ktor.server.routing.routing
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
+import moe.lava.banksia.Constants
 import moe.lava.banksia.di.CommonModules
 import moe.lava.banksia.room.dao.RouteDao
 import moe.lava.banksia.room.dao.StopDao
@@ -43,7 +44,15 @@ fun Application.module() {
 
     routing {
         get("/update") {
-            val datasetUrl = call.parameters["url"] ?: "https://opendata.transport.vic.gov.au/dataset/3f4e292e-7f8a-4ffe-831f-1953be0fe448/resource/e4966d78-dc64-4a1d-a751-2470c9eaf034/download/gtfs.zip"
+            val key = call.parameters["key"]
+            if (key != Constants.updateKey) {
+                call.respond(HttpStatusCode.Forbidden)
+                return@get
+            }
+
+            val datasetUuid = call.parameters["uuid"] ?: "e4966d78-dc64-4a1d-a751-2470c9eaf034"
+            val datasetUrl = call.parameters["url"]
+                ?: "https://opendata.transport.vic.gov.au/dataset/3f4e292e-7f8a-4ffe-831f-1953be0fe448/resource/${datasetUuid}/download/gtfs.zip"
             call.respondText("received")
             launch(context = Dispatchers.IO) {
                 val handler by inject<GtfsHandler>()
diff --git a/server/src/main/kotlin/moe/lava/banksia/server/gtfs/GtfsHandler.kt b/server/src/main/kotlin/moe/lava/banksia/server/gtfs/GtfsHandler.kt
index 213c0b9..2d15b16 100644
--- a/server/src/main/kotlin/moe/lava/banksia/server/gtfs/GtfsHandler.kt
+++ b/server/src/main/kotlin/moe/lava/banksia/server/gtfs/GtfsHandler.kt
@@ -11,6 +11,7 @@ import io.ktor.util.logging.Logger
 import io.ktor.utils.io.copyAndClose
 import kotlinx.serialization.decodeFromString
 import kotlinx.serialization.modules.EmptySerializersModule
+import moe.lava.banksia.Constants
 import moe.lava.banksia.model.Route
 import moe.lava.banksia.model.Shape
 import moe.lava.banksia.model.Stop
@@ -38,7 +39,8 @@ class GtfsHandler(
 
     suspend fun update(datasetUrl: String) {
         val parentDir = datasetPath.parentFile
-        if (parentDir.exists() && !log.isTraceEnabled) // XXX: hacky check for dev env
+        @Suppress("SimplifyBooleanWithConstants", "KotlinConstantConditions")
+        if (parentDir.exists() && !Constants.devMode)
             parentDir.deleteRecursively()
 
         parentDir.mkdirs()
@@ -53,10 +55,15 @@ class GtfsHandler(
         }
 
         log.info("extracting...")
-//        val files = extractAll(datasetPath)
-        val files = datasetPath.parentFile
-            .listFiles { it.isDirectory }
-            .flatMap { d -> d.listFiles { f -> f.extension == "txt" }.toList() }
+        @Suppress("KotlinConstantConditions")
+        val files = if (Constants.devMode) {
+            datasetPath.parentFile
+                .listFiles { it.isDirectory }
+                .flatMap { d -> d.listFiles { f -> f.extension == "txt" }.toList() }
+                .ifEmpty { extractAll(datasetPath) }
+        } else {
+            extractAll(datasetPath)
+        }
 
         addRoutes(files)
         addStops(files)
@@ -64,6 +71,11 @@ class GtfsHandler(
         addTrips(files)
         addStopTimes(files)
 
+        @Suppress("KotlinConstantConditions")
+        if (!Constants.devMode) {
+            parentDir.deleteRecursively()
+        }
+
         log.info("done!")
     }
 
diff --git a/shared/src/commonMain/kotlin/moe/lava/banksia/Constants.kt.skeleton b/shared/src/commonMain/kotlin/moe/lava/banksia/Constants.kt.skeleton
index 39bb7cf..7be0391 100644
--- a/shared/src/commonMain/kotlin/moe/lava/banksia/Constants.kt.skeleton
+++ b/shared/src/commonMain/kotlin/moe/lava/banksia/Constants.kt.skeleton
@@ -3,4 +3,8 @@ package moe.lava.banksia
 object Constants {
     const val devid: String = ""
     const val key: String = ""
+    const val serverUrl: String = "https://banksia.lava.moe/api/"
+    // TODO
+    const val devMode: Boolean = false
+    const val updateKey: String = ""
 }