diff --git a/Framework/include/QualityControl/Bookkeeping.h b/Framework/include/QualityControl/Bookkeeping.h
index a3b4d41182..c2c05ba4ac 100644
--- a/Framework/include/QualityControl/Bookkeeping.h
+++ b/Framework/include/QualityControl/Bookkeeping.h
@@ -23,6 +23,9 @@ namespace o2::quality_control::core
 {
 class Activity;
 
+// \brief A singleton class to handle the bookkeeping service interactions.
+//
+// All calls in QC code to Bookkeeping service should go through this class.
 class Bookkeeping
 {
  public:
@@ -39,6 +42,11 @@ class Bookkeeping
   void init(const std::string& url);
   void registerProcess(int runNumber, const std::string& name, const std::string& detector, bkp::DplProcessType type, const std::string& args);
 
+  // send QC flags to the bookkeeping service
+  std::vector<int> sendFlagsForSynchronous(uint32_t runNumber, const std::string& detectorName, const std::vector<QcFlag>& qcFlags);
+  std::vector<int> sendFlagsForDataPass(uint32_t runNumber, const std::string& passName, const std::string& detectorName, const std::vector<QcFlag>& qcFlags);
+  std::vector<int> sendFlagsForSimulationPass(uint32_t runNumber, const std::string& productionName, const std::string& detectorName, const std::vector<QcFlag>& qcFlags);
+
  private:
   Bookkeeping() = default;
 
diff --git a/Framework/include/QualityControl/BookkeepingQualitySink.h b/Framework/include/QualityControl/BookkeepingQualitySink.h
index 6da24857f4..5115db0f77 100644
--- a/Framework/include/QualityControl/BookkeepingQualitySink.h
+++ b/Framework/include/QualityControl/BookkeepingQualitySink.h
@@ -39,6 +39,7 @@ class BookkeepingQualitySink : public framework::Task
   // sendCallback is mainly used for testing without the necessity to do grpc calls
   BookkeepingQualitySink(const std::string& grpcUri, Provenance, SendCallback sendCallback = send);
 
+  void init(framework::InitContext&) override;
   void run(framework::ProcessingContext&) override;
 
   void endOfStream(framework::EndOfStreamContext& context) override;
diff --git a/Framework/src/Bookkeeping.cxx b/Framework/src/Bookkeeping.cxx
index a078a304db..a130690097 100644
--- a/Framework/src/Bookkeeping.cxx
+++ b/Framework/src/Bookkeeping.cxx
@@ -20,12 +20,46 @@
 #include "BookkeepingApi/BkpClientFactory.h"
 #include "BookkeepingApi/BkpClient.h"
 #include <unistd.h>
+#include <filesystem>
+#include <fstream>
 
 using namespace o2::bkp::api;
 
 namespace o2::quality_control::core
 {
 
+std::string readClientToken()
+{
+  // first we try to find the token in the environment variable
+  if (auto tokenEnv = std::getenv("QC_BKP_CLIENT_TOKEN"); tokenEnv != NULL && std::strlen(tokenEnv) > 0) {
+    ILOG(Info, Ops) << "Using token from environment variable QC_BKP_CLIENT_TOKEN" << ENDM;
+    return tokenEnv;
+  }
+
+  // if the environment variable is not set, we try to read it from a file
+  const std::string tokenFileName = "qc_bkp_client_token.txt";
+  std::filesystem::path tokenPath = std::filesystem::current_path() / tokenFileName;
+
+  std::error_code ec;
+  if (std::filesystem::exists(tokenPath, ec) && !ec.value()) {
+    std::string token;
+    std::ifstream tokenFile(tokenPath);
+    // from now on, we throw if something goes wrong, because the user is clearly trying to use a token file
+    if (!tokenFile.is_open()) {
+      throw std::runtime_error("BKP token file '" + tokenFileName + "' was provided but cannot be opened, check permissions");
+    }
+    std::getline(tokenFile, token);
+    if (token.empty()) {
+      throw std::runtime_error("BKP token file '" + tokenFileName + "' was provided but it is empty, please provide a valid token");
+    }
+    ILOG(Debug, Devel) << "Using token from file qc_bkp_client_token" << ENDM;
+    return token;
+  }
+
+  ILOG(Debug, Devel) << "Could not find an env var QC_BKP_CLIENT_TOKEN nor a qc_bkp_client_token.txt file, using BKP client without an authentication token" << ENDM;
+  return "";
+}
+
 void Bookkeeping::init(const std::string& url)
 {
   if (mInitialized) {
@@ -42,9 +76,11 @@ void Bookkeeping::init(const std::string& url)
     return;
   }
 
+  const auto token = readClientToken();
+
   try {
-    if (auto tokenEnv = std::getenv("QC_BKP_CLIENT_TOKEN"); tokenEnv != NULL) {
-      mClient = BkpClientFactory::create(url, tokenEnv);
+    if (!token.empty()) {
+      mClient = BkpClientFactory::create(url, token);
     } else {
       mClient = BkpClientFactory::create(url);
     }
@@ -79,4 +115,29 @@ void Bookkeeping::registerProcess(int runNumber, const std::string& name, const
   }
   mClient->dplProcessExecution()->registerProcessExecution(runNumber, type, getHostName(), name, args, detector);
 }
+
+std::vector<int> Bookkeeping::sendFlagsForSynchronous(uint32_t runNumber, const std::string& detectorName, const std::vector<QcFlag>& qcFlags)
+{
+  if (!mInitialized) {
+    return {};
+  }
+  return mClient->qcFlag()->createForSynchronous(runNumber, detectorName, qcFlags);
+}
+
+std::vector<int> Bookkeeping::sendFlagsForDataPass(uint32_t runNumber, const std::string& passName, const std::string& detectorName, const std::vector<QcFlag>& qcFlags)
+{
+  if (!mInitialized) {
+    return {};
+  }
+  return mClient->qcFlag()->createForDataPass(runNumber, passName, detectorName, qcFlags);
+}
+
+std::vector<int> Bookkeeping::sendFlagsForSimulationPass(uint32_t runNumber, const std::string& productionName, const std::string& detectorName, const std::vector<QcFlag>& qcFlags)
+{
+  if (!mInitialized) {
+    return {};
+  }
+  return mClient->qcFlag()->createForSimulationPass(runNumber, productionName, detectorName, qcFlags);
+}
+
 } // namespace o2::quality_control::core
diff --git a/Framework/src/BookkeepingQualitySink.cxx b/Framework/src/BookkeepingQualitySink.cxx
index 4900cd0b94..6a3c7e8b01 100644
--- a/Framework/src/BookkeepingQualitySink.cxx
+++ b/Framework/src/BookkeepingQualitySink.cxx
@@ -44,8 +44,7 @@ void BookkeepingQualitySink::customizeInfrastructure(std::vector<framework::Comp
 
 void BookkeepingQualitySink::send(const std::string& grpcUri, const BookkeepingQualitySink::FlagsMap& flags, Provenance provenance)
 {
-  auto bkpClient = o2::bkp::api::BkpClientFactory::create(grpcUri);
-  auto& qcClient = bkpClient->qcFlag();
+  auto& bkpClient = o2::quality_control::core::Bookkeeping::getInstance();
 
   std::optional<int> runNumber;
   std::optional<std::string> passName;
@@ -98,20 +97,19 @@ void BookkeepingQualitySink::send(const std::string& grpcUri, const BookkeepingQ
     try {
       switch (provenance) {
         case Provenance::SyncQC:
-          qcClient->createForSynchronous(runNumber.value(), detector, bkpQcFlags);
+          bkpClient.sendFlagsForSynchronous(runNumber.value(), detector, bkpQcFlags);
           break;
         case Provenance::AsyncQC:
-          qcClient->createForDataPass(runNumber.value(), passName.value(), detector, bkpQcFlags);
+          bkpClient.sendFlagsForDataPass(runNumber.value(), passName.value(), detector, bkpQcFlags);
           break;
         case Provenance::MCQC:
-          qcClient->createForSimulationPass(runNumber.value(), periodName.value(), detector, bkpQcFlags);
+          bkpClient.sendFlagsForSimulationPass(runNumber.value(), periodName.value(), detector, bkpQcFlags);
           break;
       }
+      ILOG(Info, Support) << "Sent " << bkpQcFlags.size() << " flags for detector '" << detector << "'" << ENDM;
     } catch (const std::runtime_error& err) {
-      ILOG(Error, Support) << "Failed to send flags for detector: " << detector
-                           << " with error: " << err.what() << ENDM;
+      ILOG(Error, Support) << "Encountered errors while sending flags for detector '" << detector << "', details: " << err.what() << ENDM;
     }
-    ILOG(Info, Support) << "Sent " << bkpQcFlags.size() << " flags for detector: " << detector << ENDM;
   }
 }
 
@@ -130,6 +128,11 @@ auto collectionForQualityObject(const QualityObject& qualityObject) -> std::uniq
     qualityObject.getActivity().mProvenance);
 }
 
+void BookkeepingQualitySink::init(framework::InitContext& context)
+{
+  o2::quality_control::core::Bookkeeping::getInstance().init(mGrpcUri);
+}
+
 void BookkeepingQualitySink::run(framework::ProcessingContext& context)
 {
   for (auto const& ref : framework::InputRecordWalker(context.inputs())) {
diff --git a/doc/Framework.md b/doc/Framework.md
index afa2db3d4d..5e0e552432 100644
--- a/doc/Framework.md
+++ b/doc/Framework.md
@@ -587,6 +587,11 @@ If you need the directory structure preserved, add the argument `--preserve-dire
 
 The framework allows to propagate Quality Objects (QOs) produced by Checks and Aggregators to RCT in Bookkeeping.
 The synchronisation is done once, at the end of workflow runtime, i.e. at the End of Run or in the last stage of QC merging on Grid.
+Check results are converted into Flags, which are documented in [O2/DataFormats/QualityControl](https://github.com/AliceO2Group/AliceO2/tree/dev/DataFormats/QualityControl).
+Information about the object validity is preserved, which allows for time-based flagging of good/bad data.
+
+### Configuration details
+
 Propagation can be enabled by adding the following key-value pair to Check/Aggregator configuration:
 
 ```json
@@ -595,10 +600,25 @@ Propagation can be enabled by adding the following key-value pair to Check/Aggre
 
 Using it for Aggregators is discouraged, as the information on which exact Check failed is lost or at least obfuscated.
 
-Also, make sure that the configuration file includes the Bookkeeping URL and there is an env var `QC_BKP_CLIENT_TOKEN` with authentication token for setups external to P2.
+To allow QC to connect to Bookkeeping, include the its URL in the QC configuration file, e.g.:
 
-Check results are converted into Flags, which are documented in [O2/DataFormats/QualityControl](https://github.com/AliceO2Group/AliceO2/tree/dev/DataFormats/QualityControl).
-Information about the object validity is preserved, which allows for time-based flagging of good/bad data.
+```json
+{
+  "qc": {
+    "config": {
+      "bookkeeping": {
+        "url": "bookkeeping.cern.ch:12345"
+      }
+    }
+  }
+}
+```
+
+For setups external to P2, one also needs to provide a BKP client token.
+It can be done by creating a file named `qc_bkp_client_token` in the working directory, containing just the token.
+In such case, please ensure minimal permissions for the file, so that it is not readable by other users.
+Alternatively, it can be provided as an environment variable `QC_BKP_CLIENT_TOKEN`.
+Then, avoid printing the environment variable in the logs.
 
 ### Conversion details