diff --git a/.env.example b/.env.example
index 156adca..db359c2 100644
--- a/.env.example
+++ b/.env.example
@@ -9,8 +9,13 @@ GITHUB_TOKEN=github_pat_...        # Fine-grained PAT, scoped to Dembrane repos
 # Linear
 LINEAR_API_KEY=lin_api_...
 
-# Notion
-NOTION_API_KEY=notion_api_...
+# Integrations (optional — skip any you don't use; upload-secrets.sh skips
+# empty values, and the runtime treats each as absent when unset)
+EXA_API_KEY=...                    # Exa web search (exa-search skill)
+NOTION_API_KEY=ntn_...             # Notion internal-integration token (PR #126 skills)
+POSTHOG_API_KEY=phx_...            # PostHog personal API key (product analytics queries)
+# ATTIO_API_KEY=...                # Attio CRM — also commented in infra/config.yaml;
+                                   # uncomment both once a key is provisioned
 
 # Google Cloud / Vertex AI (required for ADK runner)
 GOOGLE_CLOUD_PROJECT=...           # GCP project ID
diff --git a/infra/config.yaml b/infra/config.yaml
index 8e823bd..3205313 100644
--- a/infra/config.yaml
+++ b/infra/config.yaml
@@ -75,3 +75,15 @@ secrets:
   # public edge proxy in functions/ does NOT read this; it only adds an IAM
   # identity. Optional at runtime: unset → daemon doesn't expose /github/webhook.
   GITHUB_WEBHOOK_SECRET: GITHUB_WEBHOOK_SECRET
+  # Notion internal-integration token for the Dembrane workspace. Consumed by
+  # the Notion client/capability/skills shipping in PR #126; usable from
+  # session bash (`$NOTION_API_KEY`) as soon as it's mounted.
+  NOTION_API_KEY: NOTION_API_KEY
+  # PostHog personal API key — lets sessions query analytics, error tracking,
+  # and session-replay metadata for the product (Dembrane/echo).
+  POSTHOG_API_KEY: POSTHOG_API_KEY
+  # ATTIO_API_KEY: ATTIO_API_KEY
+  #   ^ plumbing prepared but deliberately commented out: no Attio key exists
+  #   in .env yet, and mounting a secret that has no version fails the Cloud
+  #   Run revision at deploy. Uncomment, then `terraform apply` +
+  #   `upload-secrets.sh`, once the operator provisions an Attio API key.