diff --git a/requirements.txt b/requirements.txt
index b048ad11..395b6ee3 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -304,6 +304,7 @@ webhelpers2==2.1
 whoosh==2.7.4
 zope.cachedescriptors==5.1.0
 qrcode==7.4.2
+configupdater~=3.2
 
 ## uncomment to add the debug libraries
 #-r requirements_debug.txt
diff --git a/rhodecode/config/config_maker.py b/rhodecode/config/config_maker.py
index 2b355be1..0b82fd96 100644
--- a/rhodecode/config/config_maker.py
+++ b/rhodecode/config/config_maker.py
@@ -24,6 +24,7 @@ from pyramid.settings import asbool
 
 from rhodecode.config.settings_maker import SettingsMaker
 from rhodecode.config import utils as config_utils
+from rhodecode.lib.config_utils import initialize_ini_config_default_values_if_not_present
 
 log = logging.getLogger(__name__)
 
@@ -260,4 +261,6 @@ def sanitize_settings_and_apply_defaults(global_config, settings):
     # configure instance id
     config_utils.set_instance_id(settings)
 
+    initialize_ini_config_default_values_if_not_present(global_config.get("__file__"))
+
     return settings
diff --git a/rhodecode/lib/config_utils.py b/rhodecode/lib/config_utils.py
index b53ee855..51296718 100644
--- a/rhodecode/lib/config_utils.py
+++ b/rhodecode/lib/config_utils.py
@@ -40,3 +40,27 @@ def get_app_config(ini_path):
     from paste.deploy.loadwsgi import appconfig
 
     return appconfig(f"config:{ini_path}", relative_to=os.getcwd())
+
+
+def initialize_ini_config_default_values_if_not_present(ini_path: str):
+    from configupdater import ConfigUpdater  # use configupdater to not break comments and formatting's
+
+    def dump_config():
+        with open(ini_path, "w") as configfile:
+            updater.write(configfile)
+
+    updater = ConfigUpdater()
+    updater.read(ini_path)
+
+    section = "app:main"
+    option = "app.service_api.token"
+
+    if not updater[section][option].value.strip():
+        updater[section][option] = generate_token()
+        dump_config()
+
+
+def generate_token(length: int = 32) -> str:
+    import secrets
+
+    return secrets.token_urlsafe(length)
diff --git a/rhodecode/lib/hook_daemon/utils.py b/rhodecode/lib/hook_daemon/utils.py
index 33d44099..ea431b98 100644
--- a/rhodecode/lib/hook_daemon/utils.py
+++ b/rhodecode/lib/hook_daemon/utils.py
@@ -19,7 +19,7 @@
 import time
 import logging
 
-from rhodecode.lib.config_utils import get_app_config_lightweight
+from rhodecode.lib.config_utils import get_app_config_lightweight, initialize_ini_config_default_values_if_not_present
 
 from rhodecode.lib.hook_daemon.base import Hooks
 from rhodecode.lib.hook_daemon.hook_module import HooksModuleCallbackDaemon
@@ -33,6 +33,7 @@ def prepare_callback_daemon(extras, protocol: str, txn_id=None):
     hooks_config = {}
     match protocol:
         case "celery":
+            initialize_ini_config_default_values_if_not_present(extras["config"])
             config = get_app_config_lightweight(extras["config"])
 
             broker_url = config.get("celery.broker_url")
diff --git a/rhodecode/lib/pyramid_utils.py b/rhodecode/lib/pyramid_utils.py
index 9afc5475..4e3bb6a2 100644
--- a/rhodecode/lib/pyramid_utils.py
+++ b/rhodecode/lib/pyramid_utils.py
@@ -21,6 +21,8 @@ import os
 from pyramid.paster import bootstrap as pyramid_bootstrap, setup_logging  # pragma: no cover
 from pyramid.threadlocal import get_current_request as pyramid_current_request
 
+from rhodecode.lib.config_utils import initialize_ini_config_default_values_if_not_present
+
 
 def bootstrap(config_uri, options=None, env=None):
     from rhodecode.config.utils import DEFAULT_USER
@@ -31,6 +33,7 @@ def bootstrap(config_uri, options=None, env=None):
     if env:
         os.environ.update(env)
 
+    initialize_ini_config_default_values_if_not_present(config_uri)
     config = get_app_config_lightweight(config_uri)
     base_url = config["app.base_url"]