diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..e9f906b
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,32 @@
+# intervalsicu-mcp-auth — environment (copy to .env; do not commit real secrets)
+
+# Public base URL of this auth server. The OAuth/OIDC issuer is <this>/api/auth.
+BETTER_AUTH_URL=https://intervalsicu.farhoodlabs.com
+# Better Auth signing secret — generate a long random string.
+BETTER_AUTH_SECRET=
+# Postgres connection string (the shared CNPG database).
+AUTH_DATABASE_URL=postgres://user:password@host:5432/dbname
+
+# Google social login credentials.
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Optional Apple sign-in (added only if all three are set).
+# APPLE_CLIENT_ID=
+# APPLE_CLIENT_SECRET=
+# APPLE_APP_BUNDLE_IDENTIFIER=
+
+# Comma-separated allowed token audiences / RFC 8707 resources — must include the
+# MCP server's /mcp URL so issued access tokens carry the right aud.
+VALID_AUDIENCES=https://intervalsicu.farhoodlabs.com/mcp
+# Comma-separated trusted origins for Better Auth.
+TRUSTED_ORIGINS=https://intervalsicu.farhoodlabs.com
+
+# Logger level: debug | info (default info).
+LOG_LEVEL=info
+# HTTP listen port (default 8080).
+PORT=8080
+
+# Portal OIDC client seeded by migrate.ts (both have defaults; override if needed).
+# PORTAL_CLIENT_ID=
+# PORTAL_REDIRECT_URI=
diff --git a/CLAUDE.md b/CLAUDE.md
index faecf91..b50dc4d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -49,9 +49,6 @@ Three source files, compiled `src/*.ts` → `dist/*.js` (NodeNext ESM, `.js` imp
 - `pool` — a shared `pg.Pool` from `AUTH_DATABASE_URL`. This is the same CNPG database the rest of
   the product uses; Better Auth's tables (`user`, `session`, `account`, `jwks`, `oauthClient`, ...)
   coexist with the app's own `users` table in the default schema.
-- **`emailAndPassword` is DEBUG-ONLY scaffolding.** Enabled only when `DEBUG_EMAIL_PASSWORD=true`;
-  it exists solely to mint a session headlessly for debugging the OAuth token exchange without a
-  browser. **It must be off in normal operation.**
 
 ### `src/server.ts` — the Node HTTP server
 
@@ -118,7 +115,6 @@ Read from the code:
 | `LOG_LEVEL` | no (`info`) | Better Auth logger level (`debug`/`info`). |
 | `PORT` | no (`8080`) | HTTP listen port. |
 | `PORTAL_CLIENT_ID` / `PORTAL_REDIRECT_URI` | no (have defaults) | Portal OIDC client seeded by `migrate.ts`. |
-| `DEBUG_EMAIL_PASSWORD` | no | **Debug only.** `=true` enables email/password auth for headless debugging. Keep off. |
 
 ## Deployment
 
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..de9cc79
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Farhood
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index cc75eec..4e63ffa 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,6 @@ npm start              # node dist/server.js
 | `LOG_LEVEL` | `debug` / `info` (default `info`). |
 | `PORT` | HTTP port (default `8080`). |
 | `PORTAL_CLIENT_ID` / `PORTAL_REDIRECT_URI` | portal client seeded by `migrate.ts` (have defaults). |
-| `DEBUG_EMAIL_PASSWORD` | **debug only** — `=true` enables email/password auth for headless OAuth debugging. Keep off in normal operation. |
 
 ## Deployment
 
diff --git a/src/auth.ts b/src/auth.ts
index d828ff6..3cc4aaf 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -52,9 +52,6 @@ export const auth = betterAuth({
   logger: { level: (process.env.LOG_LEVEL as "debug" | "info") ?? "info" },
   trustedOrigins: (process.env.TRUSTED_ORIGINS ?? "").split(",").filter(Boolean),
   database: pool,
-  // Temporary, env-gated: lets us mint a session headlessly to debug the OAuth
-  // token exchange without a browser. Off unless DEBUG_EMAIL_PASSWORD=true.
-  emailAndPassword: { enabled: process.env.DEBUG_EMAIL_PASSWORD === "true" },
   socialProviders,
   plugins: [
     // oauth-provider looks up the jwt plugin (for JWKS-verifiable access tokens)