diff --git a/.gitignore b/.gitignore
index d06f709..7302726 100644
--- a/.gitignore
+++ b/.gitignore
@@ -436,6 +436,7 @@ dist/
 *.db-shm
 *.db-wal
 mcp-server/
+.mcp.json
 
 # Toolchains installed locally by scripts/ci/lib.sh
 .dotnet/
diff --git a/.mcp.json b/.mcp.json
deleted file mode 100644
index c755c96..0000000
--- a/.mcp.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "novelly": {
-      "command": "/home/james/src/novelly/mcp-server/Novelly.Mcp",
-      "env": {
-        "NOVELLY_API_URL": "http://localhost:5080",
-        "DOTNET_ROOT": "/home/james/.dotnet"
-      }
-    }
-  }
-}
diff --git a/.mcp.json.example b/.mcp.json.example
index 71f03a2..e6ebe4d 100644
--- a/.mcp.json.example
+++ b/.mcp.json.example
@@ -3,7 +3,8 @@
     "novelly": {
       "command": "./mcp-server/Novelly.Mcp",
       "env": {
-        "NOVELLY_API_URL": "http://localhost:5080"
+        "NOVELLY_API_URL": "http://localhost:5080",
+        "NOVELLY_API_KEY": "<matches the API's Auth:ServiceApiKey user secret>"
       }
     }
   }
diff --git a/README.md b/README.md
index 3fbab77..969a092 100644
--- a/README.md
+++ b/README.md
@@ -193,21 +193,27 @@ client spawns directly, so nothing rebuilds it automatically. Re-run the script
 reconnect your MCP client) after pulling changes that touch `src/Novelly.Mcp`, or it keeps
 serving whatever was published last, including against a stale auth contract.
 
-`.mcp.json` (or Claude Desktop's config):
+Copy `.mcp.json.example` to `.mcp.json` (gitignored, since it carries your API key) and
+fill in the key:
 
 ```jsonc
 {
   "mcpServers": {
     "novelly": {
       "command": "/absolute/path/to/mcp-server/Novelly.Mcp",
-      "env": { "NOVELLY_API_URL": "http://localhost:5080" }
+      "env": {
+        "NOVELLY_API_URL": "http://localhost:5080",
+        "NOVELLY_API_KEY": "<matches the API's Auth:ServiceApiKey user secret>"
+      }
     }
   }
 }
 ```
 
-The API must be running. If it is not, the tools say so in a message the model can act on
-rather than failing opaquely.
+The API must be running, with `Auth:ServiceApiKey` set (e.g. via
+`dotnet user-secrets set Auth:ServiceApiKey <key> -p src/Novelly.Api`) to the same value
+as `NOVELLY_API_KEY` above. If the API is not running, or the key is missing or mismatched,
+the tools say so in a message the model can act on rather than failing opaquely.
 
 ### Importing an existing outline