diff --git a/qt/aqt/mediasrv.py b/qt/aqt/mediasrv.py
index cc7c4c2dd..a38790728 100644
--- a/qt/aqt/mediasrv.py
+++ b/qt/aqt/mediasrv.py
@@ -7,9 +7,8 @@ import enum
 import logging
 import mimetypes
 import os
-import random
 import re
-import string
+import secrets
 import sys
 import threading
 import traceback
@@ -765,7 +764,7 @@ def legacy_page_data() -> Response:
         return _text_response(HTTPStatus.NOT_FOUND, "page not found")
 
 
-_APIKEY = "".join(random.choices(string.ascii_letters + string.digits, k=32))
+_APIKEY = secrets.token_urlsafe(32)
 
 
 def _have_api_access() -> bool: