diff --git a/web_config.example.py b/web_config.example.py
new file mode 100644
index 0000000..756c284
--- /dev/null
+++ b/web_config.example.py
@@ -0,0 +1,11 @@
+import secrets
+
+# NOTE: change this to a constant, but secret value. 
+# if not constant:
+# - sessions will be lost on each server restart
+# if not secret:
+# - users may be able to forge sessions
+SECRET_KEY = secrets.token_urlsafe(nbytes=32)
+
+# URL (without trailing /) of the prosody HTTP server.
+PROSODY_ENDPOINT = "http://localhost:5280"