diff --git a/generate_secrets.sh b/generate_secrets.sh
new file mode 100644
index 0000000..7ba48ab
--- /dev/null
+++ b/generate_secrets.sh
@@ -0,0 +1,48 @@
+S3_ACCESS_KEY="$(openssl rand -hex 16)"
+S3_SECRET_KEY="$(openssl rand -hex 32)"
+JWT_SECRET="$(openssl rand -hex 64)"
+HASURA_ADMIN_SECRET="$(openssl rand -hex 32)"
+
+cat > secrets.env <<EOF
+# ======================
+# RepoFlow secrets
+# ======================
+
+# Used for signing cookies
+GENERAL_COOKIE_SECRET=$(openssl rand -hex 32)
+
+# ======================
+# RepoFlow server JWTs
+# ======================
+
+# MUST MATCH HASURA_GRAPHQL_JWT_SECRET.key
+JWT_SECRET=$JWT_SECRET
+
+RESET_PASSWORD_JWT_SECRET=$(openssl rand -hex 64)
+PERSONAL_ACCESS_TOKEN_JWT_SECRET=$(openssl rand -hex 64)
+
+# MUST MATCH HASURA_GRAPHQL_ADMIN_SECRET
+HASURA_ADMIN_SECRET=$HASURA_ADMIN_SECRET
+
+# ======================
+# S3 / MinIO credentials
+# These values MUST match
+# ======================
+
+S3_ACCESS_KEY=$S3_ACCESS_KEY
+S3_SECRET_KEY=$S3_SECRET_KEY
+MINIO_ROOT_USER=$S3_ACCESS_KEY
+MINIO_ROOT_PASSWORD=$S3_SECRET_KEY
+
+# ======================
+# Hasura
+# ======================
+
+# MUST MATCH HASURA_ADMIN_SECRET
+HASURA_GRAPHQL_ADMIN_SECRET=$HASURA_ADMIN_SECRET
+
+# MUST MATCH JWT_SECRET
+HASURA_GRAPHQL_JWT_SECRET={"type":"HS256","key":"$JWT_SECRET","header":{"type":"Cookie","name":"X-USER-TOKEN"}}
+EOF
+
+echo "Created secrets.env"
\ No newline at end of file
diff --git a/secrets.env b/secrets.env
new file mode 100644
index 0000000..4972a15
--- /dev/null
+++ b/secrets.env
@@ -0,0 +1,39 @@
+# ======================
+# RepoFlow secrets
+# ======================
+
+# Used for signing cookies
+GENERAL_COOKIE_SECRET=793864fa6187506aa51c6a76a6fe2e079438da02594253f1ad9c7c8001776f2b
+
+# ======================
+# RepoFlow server JWTs
+# ======================
+
+# MUST MATCH HASURA_GRAPHQL_JWT_SECRET.key
+JWT_SECRET=0321e7bad3d6d6f6e757bf409a5ac53cee6b128301f909d9fc76414b4cde57af16d9ca9890bf740d4bc9b7bc4c27c254b8997592fe95b7e3f090b45a4dc118f4
+
+RESET_PASSWORD_JWT_SECRET=1165c73ba898c8cb388e8ed40712ace9bea7604443aeee013c6a153a9317d997a62a9c548ec202347846ba6422f0ebcc654e55e08846cfdb3ca7dafbb8c2bab9
+PERSONAL_ACCESS_TOKEN_JWT_SECRET=75ff925f88e2cf3dcc81917d172e76f77718e5494cd0bc00fbafb1c40157cacbba1608e2200536fcbcc8e27e83f04727e0c32be0f68680de821c0cab6d9ff9d1
+
+# MUST MATCH HASURA_GRAPHQL_ADMIN_SECRET
+HASURA_ADMIN_SECRET=0c1ea538ba60fc79fab9f1072d5b7b6cecfa8f936522423c81c0ac7ae051b506
+
+# ======================
+# S3 / MinIO credentials
+# These values MUST match
+# ======================
+
+S3_ACCESS_KEY=0694e75be0fa0502da117b9a8718d02f
+S3_SECRET_KEY=58094a7487260dc1e1920d9b988ae3cc2cddf097c9fc565bc8dd6e2b1c3f8ff3
+MINIO_ROOT_USER=0694e75be0fa0502da117b9a8718d02f
+MINIO_ROOT_PASSWORD=58094a7487260dc1e1920d9b988ae3cc2cddf097c9fc565bc8dd6e2b1c3f8ff3
+
+# ======================
+# Hasura
+# ======================
+
+# MUST MATCH HASURA_ADMIN_SECRET
+HASURA_GRAPHQL_ADMIN_SECRET=0c1ea538ba60fc79fab9f1072d5b7b6cecfa8f936522423c81c0ac7ae051b506
+
+# MUST MATCH JWT_SECRET
+HASURA_GRAPHQL_JWT_SECRET={"type":"HS256","key":"0321e7bad3d6d6f6e757bf409a5ac53cee6b128301f909d9fc76414b4cde57af16d9ca9890bf740d4bc9b7bc4c27c254b8997592fe95b7e3f090b45a4dc118f4","header":{"type":"Cookie","name":"X-USER-TOKEN"}}