diff --git a/webservice/webservice.py b/webservice/webservice.py
index 486837c82cdcd25a85579eb101a89acd598514e1..02add4f45d4a7c8385c1c0b557eec5f376c742bb 100644
--- a/webservice/webservice.py
+++ b/webservice/webservice.py
@@ -18,6 +18,10 @@ from errors import Errors, Success
 
 
 def init_config_repo(config):
+    """ Make sure the configuration repo is present and up-to-data
+
+    :param config: the configuration defined in the `config-repo` section
+    """
     os.makedirs(config['local-path'], exist_ok=True)
     # check if it is a repo
     try:
@@ -29,6 +33,23 @@ def init_config_repo(config):
     
 
 async def upload_config(socket, config, yaml, instrument, cycle, proposal):
+    """ Upload a new configuration YAML
+
+    :param socket: ZMQ socket to send reply on
+    :param config: the configuration defined in the `config-repo` section
+        of the webservice.yaml configuration.
+    :param yaml: the YAML contents to update
+    :param instrument: instrument for which the update is for
+    :param cycle: the facility cylce the update is for
+    :param proposal: the proposal the update is for
+    
+    The YAML contents will be placed into a file at
+    
+        {config.local-path}/{cycle}/{proposal}.yaml
+
+    If it exists it is overwritten and then the new version is pushed to
+    the configuration git repo.
+    """
     repo = Repo(config['local-path'])
     # assure we are on most current version
     repo.remote().pull()
@@ -44,7 +65,18 @@ async def upload_config(socket, config, yaml, instrument, cycle, proposal):
     socket.send(Success.UPLOADED_CONFIG.format(cycle, proposal).encode())
     
 
-async def run_cmd(cmd, socket, mode, proposal, run):
+async def run_cmd(cmd, mode, proposal, run):
+    """ Run a correction command
+    
+    :param cmd: to run, should be a in list for as expected by subprocess.run
+    :param mode: "prod" or "sim", in the latter case nothing will be executed
+                 but the command will be logged
+    :param proposal: proposal the command was issued for
+    :param run: run the command was issued for
+
+    Returns a formatted Success or Error message indicating outcome of the
+    execution.
+    """
     if mode == "prod":
         ret = subprocess.run(cmd)
         if ret.returncode == 0:
@@ -108,8 +140,9 @@ async def server_runner(conf_file, mode):
 
     context = zmq.Context()
     auth = zmq.auth.thread.ThreadAuthenticator(context)
-    #auth.start()
-    #auth.allow(*CFG.SERVICE['ZMQ']['IPS'])
+    if mode == "prod":
+        auth.start()
+        auth.allow(config['allowed-ips'])
 
     socket = context.socket(zmq.REP)
     socket.zap_domain = b'global'
@@ -142,8 +175,8 @@ async def server_runner(conf_file, mode):
                with open(default_file, "r") as f:
                    pconf = yaml.load(f.read())           
 
-           in_folder = "/gpfs/exfel/exp/{}/{}/p{}/raw".format(instrument, cycle, proposal)
-           out_folder = "/gpfs/exfel/exp/{}/{}/p{}/proc".format(instrument, cycle, proposal)
+           in_folder = config['correct']['in-folder'].format(instrument=instrument, cycle=cycle, proposal=proposal)
+           out_folder = config['correct']['out-folder'].format(instrument=instrument, cycle=cycle, proposal=proposal)
            detectors = {}
            rpath = "{}/r{:04d}/".format(in_folder, int(runnr))
            if not os.path.exists(rpath):
@@ -174,7 +207,7 @@ async def server_runner(conf_file, mode):
                        cmd += ["--{}".format(key), str(value)]
                    else:
                        cmd += ["--{}".format(key)]
-               ret = await run_cmd(cmd, socket, mode, proposal, runnr)
+               ret = await run_cmd(cmd, mode, proposal, runnr)
                status.append(ret)
            socket.send(("\n".join(status)).encode())
 
diff --git a/webservice/webservice.yaml b/webservice/webservice.yaml
index 706128f56e2ae4926c498741acd44d712f6378a1..9b2434e291b7dfc8ec856b29836e58c25a48ab98 100644
--- a/webservice/webservice.yaml
+++ b/webservice/webservice.yaml
@@ -5,3 +5,8 @@ config-repo:
 web-service:
     port: 5003
     bind-to: tcp://*
+    allowed-ips: 192.168.192.41, 131.169.247.60, 131.169.4.237, 131.169.4.239, 192.168.172.50, 192.168.172.47, 192.168.172.48, 192.168.172.49, 131.169.5.189, 192.168.192.91, 192.168.176.62, 192.168.182.48
+
+correct:
+    in-folder: /gpfs/exfel/exp/{instrument}/{cycle}/p{proposal}/raw
+    out-folder: /gpfs/exfel/exp/{instrument}/{cycle}/p{proposal}/proc