diff --git a/Configuration.md b/Configuration.md
new file mode 100644
index 0000000..03b45d7
--- /dev/null
+++ b/Configuration.md
@@ -0,0 +1,49 @@
+# ⚙️ Configuration
+
+## Config File Location
+
+Credentials are stored in a platform-specific config file that is automatically found by both `uvx` and Docker:
+
+| Platform | Path |
+|----------|------|
+| macOS / Linux | `~/.config/strava-mcp-server/config.env` |
+| Windows | `%APPDATA%\strava-mcp-server\config.env` |
+
+The `auth` command creates and manages this file automatically.
+
+> **Developer override:** A local `.env` file in the current working directory always takes precedence over the global config. This is useful for testing with different Strava accounts.
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `STRAVA_CLIENT_ID` | ✅ | Your Strava API application Client ID |
+| `STRAVA_CLIENT_SECRET` | ✅ | Your Strava API application Client Secret |
+| `STRAVA_REFRESH_TOKEN` | ✅ | OAuth Refresh Token (generated by `auth`) |
+| `MCP_TRANSPORT` | ❌ | `stdio` (default) or `http` |
+| `HOST` | ❌ | Bind host for HTTP mode (default: `0.0.0.0`) |
+| `PORT` | ❌ | Bind port for HTTP mode (default: `8000`) |
+
+## Example `config.env`
+
+```env
+STRAVA_CLIENT_ID=123456
+STRAVA_CLIENT_SECRET=abcdef1234567890abcdef1234567890abcdef12
+STRAVA_REFRESH_TOKEN=bbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+## Getting Your Strava API Credentials
+
+1. Go to [https://www.strava.com/settings/api](https://www.strava.com/settings/api)
+2. Create a new application (any name and category)
+3. Set **Authorization Callback Domain** to `localhost`
+4. Copy your **Client ID** and **Client Secret**
+5. Run `uvx --from strava-mcp-server-hnrx auth` — the wizard handles the rest
+
+## Token Refresh
+
+The server uses the **refresh token** to automatically obtain new access tokens. The refresh token itself is long-lived (it doesn't expire unless you revoke access). If you ever get a `401 Unauthorized` error, simply run `auth` again to re-authenticate.
+
+---
+
+*Back to [Home](Home)*