diff --git a/.env.example b/.env.example
new file mode 100644
index 00000000..68fc233a
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,18 @@
+# nanobot on Render — environment variables.
+#
+# For a local run, copy this file to `.env` and fill in real values. On Render
+# these are set in the dashboard; both secrets are `sync: false` in render.yaml,
+# so nothing secret is ever committed. `.env` is gitignored — this example is not.
+# See README.md → "Environment variables" for details.
+
+# Anthropic API key — powers the agent's LLM calls (default model
+# anthropic/claude-opus-4-8). Get one at https://console.anthropic.com/settings/keys
+ANTHROPIC_API_KEY=sk-ant-your-key-here
+
+# WebUI access secret — the only gate on your public agent. Generate a strong
+# random value: `openssl rand -hex 32`
+NANOBOT_WEB_TOKEN=replace-with-a-long-random-string
+
+# Port the gateway's WebSocket/WebUI channel binds; Render routes public traffic
+# here. Matches channels.websocket.port in render-config.json.
+PORT=8765