diff --git a/Dockerfile b/Dockerfile
index c9e8b00..070da4d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@
 #     .
 #
 # The script is always copied to /app/mcp_time_server.py
-# and run from there, regardless of the source filename.
+# and run from there.
 
 FROM python:3.12-slim
 
@@ -34,5 +34,13 @@ EXPOSE 8080
 # Default port can be overridden at runtime with -e PORT=...
 ENV PORT=8080
 
+# API_KEY (optional):
+# - If set, requests must include:
+#     Authorization: Bearer <API_KEY>
+#     or X-API-Key: <API_KEY>
+# - If not set, the server runs without auth (for dev).
+# Example:
+#   docker run -p 8080:8080 -e API_KEY=your-secret-key mcp-time-tools
+
 # Start the MCP time tools HTTP server
 ENTRYPOINT ["python", "-u", "/app/mcp_time_server.py"]