diff --git a/backend/.env.example b/backend/.env.example
new file mode 100644
index 00000000..e89f6002
--- /dev/null
+++ b/backend/.env.example
@@ -0,0 +1,26 @@
+# Velxio backend environment variables
+# Copy this file to backend/.env and edit as needed.
+
+# JWT signing secret — REQUIRED. Use a long random string in production.
+SECRET_KEY=change-me-in-production-use-a-long-random-string
+
+# SQLite database path (async driver).
+# Docker default points at the /app/data volume.
+DATABASE_URL=sqlite+aiosqlite:////app/data/velxio.db
+
+# Directory where per-project sketch files are stored.
+DATA_DIR=/app/data
+
+# Frontend URL — used for OAuth redirects and CORS.
+FRONTEND_URL=http://localhost:5173
+
+# Google OAuth credentials (leave empty to disable Google login).
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT_URI=http://localhost:8001/api/auth/google/callback
+
+# Set to true when serving over HTTPS (controls Secure flag on JWT cookie).
+COOKIE_SECURE=false
+
+# JWT access token lifetime in minutes (default: 7 days).
+ACCESS_TOKEN_EXPIRE_MINUTES=10080