diff --git a/.gitignore b/.gitignore
index 6f02b58..a80ca96 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,6 @@
 bin/
 *.exe
 coverage.out
+
+# OAuth tokens from auth.Login / WriteTokens (mode 0600 on disk)
+tokens.json
diff --git a/README.md b/README.md
index d306c7e..a4dbeb4 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ cfg := rh.Config{
 }
 ```
 
-Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`).
+Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`). Keep `tokens.json` out of git (listed in `.gitignore`).
 
 ## Example