diff --git a/.env.example b/.env.example
new file mode 100644
index 00000000..0ebe342a
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,44 @@
+# ------------------------------------------------------------------------------
+# OpenCRE Environment Configuration
+# ------------------------------------------------------------------------------
+# Copy this file to `.env` and update the values for your environment.
+# Never commit your real `.env` file to version control.
+# ------------------------------------------------------------------------------
+# Database
+
+DEV_DATABASE_URL=postgresql://user:password@localhost:5432/opencre
+
+# Neo4j
+
+NEO4J_URL=neo4j://neo4j:password@localhost:7687
+
+# Redis
+
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_URL=redis://localhost:6379
+REDIS_NO_SSL=false
+
+# Flask
+
+FLASK_CONFIG=development
+INSECURE_REQUESTS=false
+
+# Embeddings
+
+NO_GEN_EMBEDDINGS=false
+
+# Google Auth
+
+GOOGLE_CLIENT_ID=your-client-id
+GOOGLE_CLIENT_SECRET=your-client-secret
+GOOGLE_SECRET_JSON=path/to/secret.json
+LOGIN_ALLOWED_DOMAINS=example.com
+
+# GCP
+
+GCP_NATIVE=false
+
+# Spreadsheet Auth
+
+OpenCRE_gspread_Auth=path/to/credentials.json
diff --git a/README.md b/README.md
index 57b73ae6..13a4fcdf 100644
--- a/README.md
+++ b/README.md
@@ -216,23 +216,28 @@ make docker-dev
 
 The environment variables used by OpenCRE are:
 
+## Environment Configuration
+
+Copy the example configuration file:
+
+```bash
+cp .env.example .env
 ```
-- NEO4J_URL
-- NO_GEN_EMBEDDINGS
-- FLASK_CONFIG
-- DEV_DATABASE_URL
-- INSECURE_REQUESTS
-- REDIS_HOST
-- REDIS_PORT
-- REDIS_NO_SSL
-- REDIS_URL
-- GCP_NATIVE
-- GOOGLE_SECRET_JSON
-- GOOGLE_CLIENT_ID
-- GOOGLE_CLIENT_SECRET
-- LOGIN_ALLOWED_DOMAINS
-- OpenCRE_gspread_Auth
-```
+
+Then edit `.env` and provide values appropriate for your environment.
+
+### Variables
+
+* Database: `DEV_DATABASE_URL`
+* Neo4j: `NEO4J_URL`
+* Redis: `REDIS_HOST`, `REDIS_PORT`, `REDIS_URL`, `REDIS_NO_SSL`
+* Flask: `FLASK_CONFIG`, `INSECURE_REQUESTS`
+* Embeddings: `NO_GEN_EMBEDDINGS`
+* Google Auth: `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_SECRET_JSON`, `LOGIN_ALLOWED_DOMAINS`
+* GCP: `GCP_NATIVE`
+* Spreadsheet Auth: `OpenCRE_gspread_Auth`
+
+See `.env.example` for full list and defaults.
 
 You can run the containers with:
 
diff --git a/cre.py b/cre.py
index 97e919c1..2e7a9d5c 100644
--- a/cre.py
+++ b/cre.py
@@ -4,6 +4,14 @@
 import unittest
 from typing import List
 
+# NEW: load .env automatically for local development
+try:
+    from dotenv import load_dotenv  # type: ignore
+
+    load_dotenv()
+except ImportError:
+    pass
+
 import click  # type: ignore
 import coverage  # type: ignore
 from flask_migrate import Migrate  # type: ignore