diff --git a/.env.coolify.example b/.env.coolify.example
index 142225eb..b2cf82cf 100644
--- a/.env.coolify.example
+++ b/.env.coolify.example
@@ -60,6 +60,14 @@ API_IR_TOKEN=
 # Kavenegar API key is read ONLY from this env (not the DB).
 KAVENEGAR_API_KEY=
 
+# ── Crawler service login (optional) ──
+# Shared secret that lets the crawler / content pipeline bypass the LOGIN captcha
+# only (password + rate-limit still apply). Must equal CLINICPRO_SERVICE_TOKEN on
+# the crawler side. Passed to the container via docker-compose (x-app-env).
+# Leave EMPTY unless ALTCHA is enabled — the compose ships ALTCHA_ENABLED=false, so
+# there is no captcha to bypass. Generate with: openssl rand -hex 32
+CRAWLER_SERVICE_TOKEN=
+
 # ── Notes ──
 # • Payment gateway keys (mellat/sep) are read from the DB ("Site Settings"), NOT from env.
 # • REFRESH_TOKEN_TTL / OTP_TTL / MAX_FILE_SIZE_BYTES are fixed in the compose file.
diff --git a/.env.dev b/.env.dev
index 24bd64a9..cc14f10e 100644
--- a/.env.dev
+++ b/.env.dev
@@ -3,3 +3,7 @@
 # APP_SECRET intentionally not committed here — set it in .env.local (git-ignored).
 # .env.dev loads AFTER .env.local, so a value here would override the local one.
 ###< symfony/framework-bundle ###
+
+# Crawler service login token lives in .env (CRAWLER_SERVICE_TOKEN=dev-crawler-secret-token).
+# Do NOT set it here: .env.dev overrides .env, so an empty value would disable the
+# dev bypass. Override only in .env.local if you need a different dev value.
diff --git a/.env.liara.example b/.env.liara.example
index 473c58b3..b0d260c4 100644
--- a/.env.liara.example
+++ b/.env.liara.example
@@ -49,6 +49,16 @@ ALLOWED_FRONTEND_HOSTS=ahvaz-nobat.ir,arak-nobat.ir,ardabil-nobat.ir,bandar-noba
 API_IR_BASE_URL=https://s.api.ir
 API_IR_TOKEN=
 
+# ── SMS ──
+# Kavenegar API key is read ONLY from this env (not the DB).
+KAVENEGAR_API_KEY=
+
+# ── Crawler service login (optional) ──
+# Shared secret that lets the crawler / content pipeline bypass the LOGIN captcha
+# only. Must equal CLINICPRO_SERVICE_TOKEN on the crawler side. Leave EMPTY unless
+# ALTCHA is enabled (no captcha to bypass otherwise). Generate: openssl rand -hex 32
+CRAWLER_SERVICE_TOKEN=
+
 # ── Fixed app params (same values as the compose stack) ──
 REFRESH_TOKEN_TTL=2592000
 OTP_TTL=1200