diff --git a/.env.example b/.env.example
index 493f47f..05b20c3 100644
--- a/.env.example
+++ b/.env.example
@@ -22,6 +22,11 @@ SESSION_SECRET=changeme
 # MAM API Configuration
 MAM_API_URL=http://mam-api:3000
 
+# Node Agent Authentication
+# Bearer token for node-agent to authenticate with mam-api /driver/* endpoints.
+# Generate with: openssl rand -hex 32
+NODE_AGENT_TOKEN=changeme
+
 # Auth — default to ON in production. Setting to 'false' is a dev-only escape
 # hatch that disables all auth checks and attaches a synthetic 'dev' user to
 # every request. Never run with AUTH_ENABLED=false on a network you don't control.