diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..6ec6b43
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,25 @@
+# set this to serve HTTP, otherwise you have to specify TLS cert and key
+MUSIKQUAD_INSECURE=1
+
+# paths to certificate and key files (in PEM format) for serving HTTPS
+MUSIKQUAD_TLS_CERT_PATH="./cert.pem"
+MUSIKQUAD_TLS_KEY_PATH="./key.pem"
+
+# the port the public APIs will be served on
+MUSIKQUAD_PORT=5505
+# the port the internal APIs will be served on
+MUSIKQUAD_INTERNAL_PORT=5506
+# where the tokens will be read from / written to
+MUSIKQUAD_TOKENS_FILE=./tokens.txt
+# how many seconds to wait before revoking scoped tokens
+# note: scoped tokens are not persisted, so they will be gone if the server is shutdown
+MUSIKQUAD_SCOPED_EXPIRY_DURATION=3600
+
+# address of where the musikcubed server is located
+MUSIKQUAD_MUSIKCUBED_ADDRESS=localhost
+# metadata port of the musikcubed server
+MUSIKQUAD_MUSIKCUBED_METADATA_PORT=7905
+# http data port of the musikcubed server
+MUSIKQUAD_MUSIKCUBED_HTTP_PORT=7906
+# the password of the musikcubed server
+MUSIKQUAD_MUSIKCUBED_PASSWORD=""
\ No newline at end of file
diff --git a/README.md b/README.md
index 1be4250..5c18c3e 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,13 @@
 
 A proxy server for musikcubed that implements TLS, alternative authentication solution and CORS for proper Web support. Compatible with musikcube.
 
-# API (public)
+### Configuration
+
+The configuration is done via `MUSIKQUAD_*` environment variables. Alternatively you can also provide a `.env` file in the same directory as the binary or a parent directory, which will be readed and loaded as environment variables.
+
+See `.env.example` for a commented `.env` file.
+
+### API (public)
 
 All of the `musikcubed` APIs are implemented. On top of those:
 
@@ -11,7 +17,7 @@ All of the `musikcubed` APIs are implemented. On top of those:
 - `share/info/:scoped_token`: Returns information (title, album, artist etc.) of the music corresponding to the specified `scoped_token` in JSON. Returns `404 Not Found` if the requested music isn't available.
 - `share/thumbnail/:scoped_token`: Returns the thumbnail for the music corresponding to the specified `scoped_token`. Returns `404 Not Found` if the requested thumbnail isn't available.
 
-# API (internal)
+### API (internal)
 
 These are only exposed to `localhost` clients.