diff --git a/devstack/README.rst b/devstack/README.rst
index eaa6436..31c3f11 100644
--- a/devstack/README.rst
+++ b/devstack/README.rst
@@ -14,6 +14,13 @@ To configure DevStack to enable OSProfiler edit
 
 to the ``[[local|localrc]]`` section.
 
+One can also configure a set of HMAC secrets, that are used for triggering of
+profiling in OpenStack services: only the requests that specify one of these
+keys in HTTP headers will be profiled. E.g. multiple secrets are specified as
+a comma-separated list of string values::
+
+    OSPROFILER_HMAC_KEYS=swordfish,foxtrot,charlie
+
 .. note:: The order of enabling plugins matter.
 
 Run DevStack as normal::
diff --git a/devstack/lib/osprofiler b/devstack/lib/osprofiler
index 732550b..8c72b58 100644
--- a/devstack/lib/osprofiler
+++ b/devstack/lib/osprofiler
@@ -50,7 +50,7 @@ function configure_osprofiler() {
         then
             iniset $conf profiler enabled True
             iniset $conf profiler trace_sqlalchemy True
-            iniset $conf profiler hmac_keys SECRET_KEY
+            iniset $conf profiler hmac_keys $OSPROFILER_HMAC_KEYS
         fi
     done
     CEILOMETER_CONF=/etc/ceilometer/ceilometer.conf
diff --git a/devstack/settings b/devstack/settings
index dc01705..ac689c9 100644
--- a/devstack/settings
+++ b/devstack/settings
@@ -1,3 +1,8 @@
 # Devstack settings
 
+# A comma-separated list of secrets, that will be used for triggering
+# of profiling in OpenStack services: profiling is only performed for
+# requests that specify one of these keys in HTTP headers.
+OSPROFILER_HMAC_KEYS=${OSPROFILER_HMAC_KEYS:-"SECRET_KEY"}
+
 enable_service osprofiler