diff --git a/aid/config.go b/aid/config.go
index 2f40107..cd96bfd 100644
--- a/aid/config.go
+++ b/aid/config.go
@@ -37,6 +37,7 @@ type CS struct {
 		Host string
 		Port string
 		FrontendPort string
+		Debug bool
 	}
 	JWT struct {
 		Secret string
@@ -139,6 +140,8 @@ func LoadConfig(file []byte) {
 		Config.API.FrontendPort = Config.API.Port
 	}
 
+	Config.API.Debug = cfg.Section("api").Key("debug").MustBool(false)
+
 	Config.JWT.Secret = cfg.Section("jwt").Key("secret").String()
 	if Config.JWT.Secret == "" {
 		panic("JWT Secret is empty")
@@ -168,6 +171,6 @@ func LoadConfig(file []byte) {
 
 	Config.Fortnite.Season = parsedSeason
 	Config.Fortnite.Everything = cfg.Section("fortnite").Key("everything").MustBool(false)
-	Config.Fortnite.Password = cfg.Section("fortnite").Key("disable_password").MustBool(false)
+	Config.Fortnite.Password = !(cfg.Section("fortnite").Key("disable_password").MustBool(false))
 	Config.Fortnite.DisableClientCredentials = cfg.Section("fortnite").Key("disable_client_credentials").MustBool(false)
 }
\ No newline at end of file
diff --git a/default.config.ini b/default.config.ini
index 697dec7..13982ab 100644
--- a/default.config.ini
+++ b/default.config.ini
@@ -41,7 +41,7 @@ guild="1234567890..."
 ; level of logging
 ; info = backend logs
 ; time = backend logs + time taken for database queries
-; prod = only errors // this will also disable the risky endpoints
+; prod = only errors
 level="info"
 
 [api]
@@ -52,6 +52,10 @@ port=":3000"
 ; if you are running the api on a server, you would set this to the ip of the server or the domain name
 ; localhost will not work with the xmpp from testing
 host="127.0.0.1"
+; this will enable some routes to show information about the backend
+; this is useful for debugging 
+; this should be disabled in production
+debug=true
 
 [jwt]
 ; secret for jwt signing
@@ -64,9 +68,9 @@ build=5.41
 ; if you want to disable this, set this to false
 everything=true
 ; enable or disable the requirement of password to login to an account
-; if this is set to false, you can login to any account with just the username
-; if this is true you must login using an exchange code given by the bot
-disable_password=true
+; if this is set to true, you can login to any account using the username and any password
+; if this is false you must login using an exchange code given by the bot
+disable_password=false
 ; if you recieve lots of /account/api/oauth/token requests, set this to true
 ; this will disable the client credentials grant type
 ; however this will also disable a user to get the hotfixes before login
diff --git a/main.go b/main.go
index 541436e..e668225 100644
--- a/main.go
+++ b/main.go
@@ -155,7 +155,7 @@ func main() {
 
 	snow := r.Group("/snow")
 	snow.Get("/image/:playlist", handlers.GetPlaylistImage)
-	if aid.Config.Output.Level != "prod" {
+	if aid.Config.API.Debug {
 		snow.Get("/cache", handlers.GetCachedPlayers)
 		snow.Get("/config", handlers.GetSnowConfig)
 		snow.Get("/sockets", handlers.GetConnectedSockets)