diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..99c14b2
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,16 @@
+# Gantt Board Environment Variables
+# Copy to .env.local for local development.
+
+# Supabase core config
+NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-public-key-here
+SUPABASE_SERVICE_ROLE_KEY=your-service-role-secret-key-here
+
+# Optional: machine-to-machine API auth (for Mission Control / other services)
+# If set, API routes can authenticate with:
+# - Authorization: Bearer <GANTT_MACHINE_TOKEN>
+# - or x-gantt-machine-token: <GANTT_MACHINE_TOKEN>
+GANTT_MACHINE_TOKEN=
+GANTT_MACHINE_USER_ID=machine-service-user
+GANTT_MACHINE_USER_NAME=Mission Control Service
+GANTT_MACHINE_USER_EMAIL=mission-control@internal.local
diff --git a/.gitignore b/.gitignore
index e18db88..aea2b5f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,8 @@ yarn-error.log*
 
 # env files (can opt-in for committing if needed)
 .env*
+!.env.example
+!.env.local.example
 
 # vercel
 .vercel