diff --git a/deploy/README.md b/deploy/README.md
index 281dd83..82a8baa 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -37,6 +37,8 @@ Before starting the service, set `CHGRID_HOST_ORIGIN` in `server/.env` to the ex
 CHGRID_HOST_ORIGIN=https://example.com
 ```
 
+The expected env shape is also shown in [server/.env.sample](/home/jjm/code/chgrid/server/.env.sample).
+
 ## 3) Publish Client
 
 ```bash
diff --git a/docs/local.md b/docs/local.md
index c393c3e..b183300 100644
--- a/docs/local.md
+++ b/docs/local.md
@@ -25,6 +25,7 @@ Defaults:
 - Client dev default is `localhost:5173`.
 - Auth requires `CHGRID_AUTH_SECRET` in environment.
 - Browser-origin enforcement requires `CHGRID_HOST_ORIGIN` in environment.
+- A starter env file is available at `server/.env.sample`.
 - Saved login uses server-managed `HttpOnly` cookie (`chgrid_session_token`) via `GET /auth/session/set` and `GET /auth/session/clear` (both require `X-Chgrid-Auth-Client: 1`).
 
 ## Quick Restarts
diff --git a/server/.env.sample b/server/.env.sample
new file mode 100644
index 0000000..36741db
--- /dev/null
+++ b/server/.env.sample
@@ -0,0 +1,2 @@
+CHGRID_AUTH_SECRET=replace-with-a-long-random-secret
+CHGRID_HOST_ORIGIN=https://example.com