diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..aea6aa6
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,6 @@
+# Copy to .env and fill in your values.
+# Get your token: admin panel → Company → API tab → Company token
+
+ETHICA_TOKEN=paste-your-company-token-here
+ETHICA_HOME=https://ethica.no
+# ETHICA_INTERVAL=60
diff --git a/.gitignore b/.gitignore
index 025ddc6..4b8a2e0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 ethica-agent.yml
+.env
 __pycache__/
 *.pyc
diff --git a/docker-compose.example.yml b/docker-compose.example.yml
index 799dbed..6da3221 100644
--- a/docker-compose.example.yml
+++ b/docker-compose.example.yml
@@ -3,5 +3,6 @@ services:
     image: ethica-agent:latest
     build: .
     restart: unless-stopped
+    env_file: .env               # ETHICA_TOKEN, ETHICA_HOME, ETHICA_INTERVAL
     volumes:
       - ./ethica-agent.yml:/config/ethica-agent.yml:ro
diff --git a/ethica-agent.example.yml b/ethica-agent.example.yml
index e418888..6fedd3e 100644
--- a/ethica-agent.example.yml
+++ b/ethica-agent.example.yml
@@ -1,9 +1,13 @@
 # Ethica Agent configuration
-# Get your token from the admin panel: Company → API tab → Company token
+#
+# Token (required): set via ETHICA_TOKEN env var (recommended) or here.
+# Get it from: admin panel → Company → API tab → Company token
+#
+# token: REPLACE_ME          ← or set ETHICA_TOKEN in .env / environment
+# home: https://ethica.no   ← or set ETHICA_HOME  (default: https://ethica.no)
+# interval: 60               ← or set ETHICA_INTERVAL (seconds, default: 60)
 
-token: REPLACE_ME
-home: https://ethica.no
-interval: 60        # seconds between collection runs
+interval: 60
 
 widgets:
 
diff --git a/ethica-agent.py b/ethica-agent.py
index d1457ab..823a75c 100644
--- a/ethica-agent.py
+++ b/ethica-agent.py
@@ -309,14 +309,18 @@ def main():
         print(f"Config not found: {args.config}", file=sys.stderr)
         sys.exit(1)
 
-    token = cfg.get("token", "")
-    home = cfg.get("home", "https://ethica.no")
-    interval = int(cfg.get("interval", 60))
-    widgets = cfg.get("widgets", [])
+    # Env vars override config file — keeps secrets out of the yml.
+    # ETHICA_TOKEN  : company API token  (required)
+    # ETHICA_HOME   : home URL           (optional, default https://ethica.no)
+    # ETHICA_INTERVAL: collection interval in seconds (optional)
+    token    = os.environ.get("ETHICA_TOKEN")    or cfg.get("token", "")
+    home     = os.environ.get("ETHICA_HOME")     or cfg.get("home", "https://ethica.no")
+    interval = int(os.environ.get("ETHICA_INTERVAL") or cfg.get("interval", 60))
+    widgets  = cfg.get("widgets", [])
 
     if not token or token == "REPLACE_ME":
-        print("Set 'token' in your config (Company → API in the admin panel).",
-              file=sys.stderr)
+        print("Set ETHICA_TOKEN env var or 'token' in config "
+              "(Company → API tab in the admin panel).", file=sys.stderr)
         sys.exit(1)
     if not widgets:
         print("No widgets configured — nothing to do.", file=sys.stderr)