diff --git a/.env.example b/.env.example
index 1975ad0..9898a63 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,6 @@
 CARGORADAR_PORT=8080
 ADMIN_TOKEN=
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000
diff --git a/.env.nas.example b/.env.nas.example
index 52e6b7f..d04ea7d 100644
--- a/.env.nas.example
+++ b/.env.nas.example
@@ -1,5 +1,6 @@
 CARGORADAR_PORT=18081
 ADMIN_TOKEN=change_this_admin_token
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000
diff --git a/README.md b/README.md
index d926cd3..3290898 100644
--- a/README.md
+++ b/README.md
@@ -125,6 +125,18 @@ The default driver is:
 
 Change the token before real use.
 
+## Admin Access
+
+For sample/demo operation, admin API token checks are disabled by default:
+
+```text
+ADMIN_AUTH_REQUIRED=false
+```
+
+With this setting, the control screen works regardless of the admin token value
+entered in the URL or prompt. Before real deployment, set
+`ADMIN_AUTH_REQUIRED=true` and use a strong `ADMIN_TOKEN`.
+
 ## Test Simulator
 
 The built-in simulator creates 10 test vehicles with fixed device tokens and
diff --git a/apps/server/src/server.js b/apps/server/src/server.js
index 79f24f6..a45d2d8 100644
--- a/apps/server/src/server.js
+++ b/apps/server/src/server.js
@@ -9,6 +9,7 @@ const PORT = Number(process.env.PORT || 8080);
 const DATA_DIR = process.env.DATA_DIR || path.resolve(__dirname, "..", "data");
 const WEB_ROOT = process.env.WEB_ROOT || path.resolve(__dirname, "..", "..", "web", "public");
 const ADMIN_TOKEN = process.env.ADMIN_TOKEN || "";
+const ADMIN_AUTH_REQUIRED = parseBoolean(process.env.ADMIN_AUTH_REQUIRED, false);
 const DEFAULT_KAKAO_JAVASCRIPT_KEY = "07f4728599ceaf4299f77c772a135423";
 const SIMULATOR_ENABLED = parseBoolean(process.env.SIMULATOR_ENABLED, true);
 const SIMULATOR_INTERVAL_MS = clampNumber(Number(process.env.SIMULATOR_INTERVAL_MS || 4000), 1000, 60000);
@@ -650,7 +651,7 @@ function addCorsHeaders(res) {
 }
 
 function authorizeAdmin(req, res) {
-  if (!ADMIN_TOKEN) return true;
+  if (!ADMIN_AUTH_REQUIRED || !ADMIN_TOKEN) return true;
 
   const token = extractToken(req, "x-admin-token");
   const requestUrl = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
diff --git a/docs/SYNOLOGY.md b/docs/SYNOLOGY.md
index 49fa15a..1c6e90b 100644
--- a/docs/SYNOLOGY.md
+++ b/docs/SYNOLOGY.md
@@ -44,6 +44,7 @@ tested with `curl -k` while the certificate is being prepared.
 ```text
 CARGORADAR_PORT=8080
 ADMIN_TOKEN=
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000
@@ -55,12 +56,15 @@ host port is `18081` because `18080` is already forwarded for `opendaw`.
 ```text
 CARGORADAR_PORT=18081
 ADMIN_TOKEN=change_this_admin_token
+ADMIN_AUTH_REQUIRED=false
 KAKAO_JAVASCRIPT_KEY=07f4728599ceaf4299f77c772a135423
 SIMULATOR_ENABLED=true
 SIMULATOR_INTERVAL_MS=4000
 ```
 
-`ADMIN_TOKEN` can stay blank during local MVP testing. For NAS exposure, set it.
+`ADMIN_AUTH_REQUIRED=false` keeps the sample control screen open regardless of
+the entered admin token. For real operation, set `ADMIN_AUTH_REQUIRED=true` and
+use a strong `ADMIN_TOKEN`.
 Set `SIMULATOR_ENABLED=false` when real Android phones are ready to provide
 driver locations.
 If opening the app directly by port, use: