diff --git a/packages/xpub-collabra/config/client.js b/packages/xpub-collabra/config/client.js
deleted file mode 100644
index 8089a152f766026fa78d58d649ca1cffc2373290..0000000000000000000000000000000000000000
--- a/packages/xpub-collabra/config/client.js
+++ /dev/null
@@ -1,8 +0,0 @@
-module.exports = {
-  'pubsweet-client': {
-    'API_ENDPOINT': 'http://localhost:3000/api',
-    'login-redirect': '/',
-    'redux-log': false,
-    theme: process.env.PUBSWEET_THEME
-  },
-}
diff --git a/packages/xpub-collabra/config/default.js b/packages/xpub-collabra/config/default.js
index aacc2e3e616a5c71428878109b764b87015020cd..749f2f6f4cb634d2f7ec1aa5584d637c75962b3f 100644
--- a/packages/xpub-collabra/config/default.js
+++ b/packages/xpub-collabra/config/default.js
@@ -17,6 +17,12 @@ module.exports = {
   'pubsweet-server': {
     dbPath: process.env.PUBSWEET_DB || path.join(__dirname, '..', 'api', 'db', environment),
   },
+  'pubsweet-client': {
+    API_ENDPOINT: 'http://localhost:3000/api',
+    'login-redirect': '/',
+    'redux-log': false,
+    theme: process.env.PUBSWEET_THEME
+  },
   'mail-transport': {
     sendmail: true
   },
@@ -30,4 +36,5 @@ module.exports = {
     password: process.env.INK_PASSWORD,
     maxRetries: 500
   },
+  publicKeys: ['pubsweet-client', 'authsome', 'validations'],
 }
diff --git a/packages/xpub-collabra/webpack/common-resolve.js b/packages/xpub-collabra/webpack/common-resolve.js
index 92f0b56f18bf4451a3c769d9c9e67761204b71d0..0ba87dc649b3e38bbab90b77b7ba31be398c030a 100644
--- a/packages/xpub-collabra/webpack/common-resolve.js
+++ b/packages/xpub-collabra/webpack/common-resolve.js
@@ -1,4 +1,14 @@
 const path = require('path')
+const config = require('config')
+const fs = require('fs-extra')
+const {pick} = require('lodash')
+
+// can't use node-config in webpack so save whitelisted client config into the build and alias it below
+const outputPath = path.resolve(__dirname, '..', '_build', 'assets')
+const clientConfig = pick(config, config.publicKeys)
+fs.ensureDirSync(outputPath)
+const clientConfigPath = path.join(outputPath, 'client-config.json')
+fs.writeJsonSync(clientConfigPath, clientConfig, {spaces: 2})
 
 module.exports = {
   // symlinks: false, // needed so that babel doesn't look for plugins in components
@@ -10,7 +20,7 @@ module.exports = {
   ],
   alias: {
     joi: 'joi-browser',
-    config: path.resolve(__dirname, '../config/client')
+    config: clientConfigPath
   },
   extensions: ['.js', '.jsx'],
 }