diff --git a/README.md b/README.md
index c6505d5..239440d 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,7 @@ The Damus API backend for Damus Purple and other functionality.
 
 - `DB_PATH`: Path to the folder where to save mdb files.
 - `DEEPL_KEY`: API key for DeepL translation service (Can be set to something bogus for local testing with mock translations)
+- `TESTFLIGHT_URL`: URL for the TestFlight app (optional)
 
 #### Apple In-App Purchase (IAP)
 
@@ -32,6 +33,13 @@ The Damus API backend for Damus Purple and other functionality.
 - `LN_RUNE`: The public node ID of the Lightning Network node
 - `TEST_PRODUCTS`: Set to `"true"` to enable test products for Lightning Network payments with a value of 1 satoshi (for testing only)
 
+
+#### OTP login
+
+- `OTP_MAX_TRIES`: The maximum number of OTP tries allowed before locking the user out. Defaults to 10.
+- `SESSION_EXPIRY`: The time in seconds before a session expires. Defaults to 1 week.
+- `OTP_EXPIRY`: The time in seconds before an OTP expires. Defaults to 5 minutes.
+
 #### Extras
 
 - `CORS_ALLOWED_ORIGINS` (optional): Comma separated list of allowed origins for CORS. Generally only needed for testing or staging.