diff --git a/backend/auth.js b/backend/auth.js
index d2bb446..078d721 100644
--- a/backend/auth.js
+++ b/backend/auth.js
@@ -53,8 +53,9 @@ const buildTokenResponse = (user) => {
 
 const login = async (email, password) => {
     const normalizedEmail = normalizeEmail(email);
+    const normalizedPassword = String(password || '').trim();
 
-    if (normalizedEmail === normalizeEmail(ADMIN_EMAIL) && password === ADMIN_PASSWORD) {
+    if (normalizedEmail === normalizeEmail(ADMIN_EMAIL) && normalizedPassword === ADMIN_PASSWORD) {
         return buildTokenResponse({
             id: null,
             name: 'Super Admin',
@@ -64,7 +65,7 @@ const login = async (email, password) => {
     }
 
     const dbUser = await findUserByEmail(normalizedEmail);
-    if (!dbUser || !dbUser.is_active || !verifyPassword(password, dbUser.password_hash)) {
+    if (!dbUser || !dbUser.is_active || !verifyPassword(normalizedPassword, dbUser.password_hash)) {
         return null;
     }
 
diff --git a/backend/config.js b/backend/config.js
index ab522b6..275e606 100644
--- a/backend/config.js
+++ b/backend/config.js
@@ -1,11 +1,21 @@
 require('dotenv').config();
 
+const cleanEnvValue = (value, fallback) => {
+    const rawValue = value ?? fallback;
+    const trimmedValue = String(rawValue || '').trim();
+    const quote = trimmedValue[0];
+    const hasMatchingQuotes = (quote === '"' || quote === "'") && trimmedValue.endsWith(quote);
+
+    return hasMatchingQuotes ? trimmedValue.slice(1, -1) : trimmedValue;
+};
+
 module.exports = {
     PORT: process.env.PORT || 3004,
-    API_KEY: process.env.API_KEY || 'nexstar_secret_key_123',
-    ADMIN_EMAIL: process.env.ADMIN_EMAIL || 'admin@admin.com',
-    ADMIN_PASSWORD: process.env.ADMIN_PASSWORD || 'admin123',
-    JWT_SECRET: process.env.JWT_SECRET || 'super_secret_jwt_key_123',
+    API_KEY: cleanEnvValue(process.env.API_KEY, 'nexstar_secret_key_123'),
+    ADMIN_EMAIL: cleanEnvValue(process.env.ADMIN_EMAIL || process.env.SUPER_ADMIN_EMAIL, 'admin@admin.com'),
+    ADMIN_PASSWORD: cleanEnvValue(process.env.ADMIN_PASSWORD || process.env.SUPER_ADMIN_PASSWORD, 'admin123'),
+    JWT_SECRET: cleanEnvValue(process.env.JWT_SECRET, 'super_secret_jwt_key_123'),
     DATABASE_URL: process.env.DATABASE_URL || 'postgres://graphuser:graphpassword@localhost:5432/graphdb',
-    N8N_WHATSAPP_TRIGGER_URL: process.env.N8N_WHATSAPP_TRIGGER_URL || 'http://localhost:5678/webhook/whatsapp'
+    N8N_WHATSAPP_TRIGGER_URL: cleanEnvValue(process.env.N8N_WHATSAPP_TRIGGER_URL, 'http://localhost:5678/webhook/whatsapp'),
+    cleanEnvValue
 };
diff --git a/backend/test/config.test.js b/backend/test/config.test.js
new file mode 100644
index 0000000..f17b1ce
--- /dev/null
+++ b/backend/test/config.test.js
@@ -0,0 +1,16 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const config = require('../config');
+
+test('cleanEnvValue trims env values and removes matching wrapper quotes', () => {
+    assert.equal(config.cleanEnvValue('  admin@example.com  ', 'fallback'), 'admin@example.com');
+    assert.equal(config.cleanEnvValue('"secret-pass"', 'fallback'), 'secret-pass');
+    assert.equal(config.cleanEnvValue("'secret-pass'", 'fallback'), 'secret-pass');
+});
+
+test('cleanEnvValue keeps unmatched quote characters inside values', () => {
+    assert.equal(config.cleanEnvValue('Compor@2017#', 'fallback'), 'Compor@2017#');
+    assert.equal(config.cleanEnvValue('secret"pass', 'fallback'), 'secret"pass');
+    assert.equal(config.cleanEnvValue('"secret-pass', 'fallback'), '"secret-pass');
+});