diff --git a/flash/apps/local-testing.mdx b/flash/apps/local-testing.mdx
index 8b3458a9..a0f12cf3 100644
--- a/flash/apps/local-testing.mdx
+++ b/flash/apps/local-testing.mdx
@@ -155,12 +155,22 @@ flash run --auto-provision
 
 **Authentication errors**
 
-Ensure `RUNPOD_API_KEY` is set in your `.env` file or environment:
+Run `flash login` to authenticate:
+
+```bash
+flash login
+```
+
+Alternatively, set `RUNPOD_API_KEY` as an environment variable or in your `.env` file:
 
 ```bash
 export RUNPOD_API_KEY="your_api_key_here"
 ```
 
+<Note>
+Values in your `.env` file are only available locally for CLI commands. They are not passed to deployed endpoints.
+</Note>
+
 ## Next steps
 
 - [Deploy to production](/flash/apps/deploy-apps) when your app is ready.
diff --git a/flash/cli/login.mdx b/flash/cli/login.mdx
index 7d364299..da3200fb 100644
--- a/flash/cli/login.mdx
+++ b/flash/cli/login.mdx
@@ -57,16 +57,20 @@ Instead of using `flash login`, you can set your API key directly as an environm
 export RUNPOD_API_KEY=your_api_key_here
 ```
 
-Or add it to your project's `.env` file:
+Or add it to your project's `.env` file for local CLI use:
 
 ```bash
 RUNPOD_API_KEY=your_api_key_here
 ```
 
-You can generate an API key with the correct permissions from [Settings > API Keys](https://www.runpod.io/console/user/settings) in the Runpod console.
+Generate an API key from [Settings > API Keys](https://www.runpod.io/console/user/settings) in the Runpod console.
 
 <Warning>
-Your Runpod API key needs **All** access permissions to your Runpod account. 
+Values in your `.env` file are only used for local CLI commands and development. They are **not** passed to deployed endpoints. To set environment variables on deployed endpoints, use the `env` parameter in your endpoint configuration. See [Endpoint parameters](/flash/configuration/parameters#env) for details.
+</Warning>
+
+<Warning>
+Your Runpod API key needs **All** access permissions.
 </Warning>
 
 
diff --git a/flash/configuration/parameters.mdx b/flash/configuration/parameters.mdx
index 57639eba..a79c75f7 100644
--- a/flash/configuration/parameters.mdx
+++ b/flash/configuration/parameters.mdx
@@ -282,6 +282,24 @@ async def load_model():
     ...
 ```
 
+<Warning>
+Values in your project's `.env` file are only available locally for CLI commands and development. They are **not** passed to deployed endpoints. You must declare environment variables explicitly using the `env` parameter.
+</Warning>
+
+To pass a local environment variable to your deployed endpoint, read it from `os.environ`:
+
+```python
+import os
+
+@Endpoint(
+    name="ml-worker",
+    gpu=GpuGroup.ANY,
+    env={"HF_TOKEN": os.environ["HF_TOKEN"]}  # Read from local env, pass to workers
+)
+async def load_model():
+    ...
+```
+
 <Note>
 Environment variables are excluded from configuration hashing. Changing environment values won't trigger endpoint recreation, making it easy to rotate API keys.
 </Note>
diff --git a/flash/troubleshooting.mdx b/flash/troubleshooting.mdx
index 7eb6f656..1a9bc058 100644
--- a/flash/troubleshooting.mdx
+++ b/flash/troubleshooting.mdx
@@ -82,19 +82,29 @@ RUNPOD_API_KEY environment variable is required but not set
 
 1. Generate an API key from [Settings > API Keys](https://www.runpod.io/console/user/settings) in the Runpod console. The key needs **All** access permissions.
 
-2. Set the key using one of these methods:
+2. Authenticate using one of these methods:
 
-   **Option 1: Environment variable**
+   **Option 1: Use `flash login` (recommended)**
+   ```bash
+   flash login
+   ```
+   Opens your browser for authentication and saves your credentials.
+
+   **Option 2: Environment variable**
    ```bash
    export RUNPOD_API_KEY="your_api_key"
    ```
 
-   **Option 2: .env file in your project root**
+   **Option 3: .env file for local CLI use**
    ```bash
    echo "RUNPOD_API_KEY=your_api_key" > .env
    ```
 
-   **Option 3: Add to your shell profile (`~/.bashrc` or `~/.zshrc`) for global authorization**
+   <Note>
+   Values in your `.env` file are only available locally for CLI commands. They are not passed to deployed endpoints.
+   </Note>
+
+   **Option 4: Shell profile for persistent local access**
    ```bash
    echo 'export RUNPOD_API_KEY="your_api_key"' >> ~/.bashrc
    source ~/.bashrc