diff --git a/README.md b/README.md
index 63e98d7..281b52f 100644
--- a/README.md
+++ b/README.md
@@ -31,3 +31,39 @@ MEILI_URL=http://localhost:7700 MEILI_KEY=$MEILI_MASTER_KEY ./ingest/ingest_kiwi
 ```
 - Reads `.env` for `OPENWEBUI_URL`, `OPENWEBUI_API_KEY`, `OPENWEBUI_KB_NAME`.
 - Uploads `*.txt`, `*.md`, `*.html` it finds in `./transcripts` and `./library/web` by default.
+
+
+## Generating required secrets
+
+### 1. Meilisearch master key
+Meilisearch needs a strong master key (like a root password). Generate one locally:
+
+```bash
+# On Linux or Mac with OpenSSL installed
+openssl rand -hex 32
+
+# Example output (keep it secret, do not reuse this exact value):
+92e4d0d2e4c6f489a91dfc30b6fd6c985f6780ad827f1e7ce1bb3c6dc81d562b
+```
+
+Then put it in your `.env`:
+
+```dotenv
+MEILI_MASTER_KEY=92e4d0d2e4c6f489a91dfc30b6fd6c985f6780ad827f1e7ce1bb3c6dc81d562b
+MEILI_KEY=${MEILI_MASTER_KEY}
+```
+
+### 2. OpenWebUI API key
+To allow PodX to push documents into your OpenWebUI Knowledge Base, create an API key:
+
+1. Go to your running OpenWebUI (e.g. [http://localhost:3003](http://localhost:3003)).
+2. Log in with your admin account.
+3. Navigate to **Settings → API Keys**.
+4. Click **Generate new API key**, give it a name like `podx-worker`.
+5. Copy the generated key and add it to `.env`:
+
+```dotenv
+OPENWEBUI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+If the key is ever leaked, revoke it in OpenWebUI and generate a new one.
diff --git a/app/Dockerfile b/app/Dockerfile
index bff1346..35eee31 100644
--- a/app/Dockerfile
+++ b/app/Dockerfile
@@ -1,7 +1,11 @@
 FROM python:3.11-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg curl jq poppler-utils \    && rm -rf /var/lib/apt/lists/*
+    ffmpeg \
+    curl \
+    jq \
+    poppler-utils \
+ && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 COPY requirements.txt .
@@ -11,4 +15,4 @@ COPY app.py worker.py ./
 RUN pip install --no-cache-dir gunicorn==22.0.0
 
 EXPOSE 8080
-CMD ["gunicorn", "-b", "0.0.0.0:8080", "app:app", "--workers", "2", "--threads", "4"]
+CMD ["gunicorn", "-b", "0.0.0.0:8080", "app:app", "--workers", "2", "--threads", "4"]
\ No newline at end of file