diff --git a/.env.example b/.env.example
index f74dde0..8b10dbd 100644
--- a/.env.example
+++ b/.env.example
@@ -1,56 +1,92 @@
-# Application
-BASE_URL=http://localhost:3069 PORT=3000 NODE_ENV=development
+# RayLab Core - contoh konfigurasi environment
+# Salin file ini menjadi .env dan isi nilai-nilai sensitif sesuai environment Anda.
+# Jangan commit .env yang berisi secrets ke VCS.
 
-# Database (PostgreSQL)
-DATABASE_URL=postgresql://user:password@localhost:5432/Database?shema=public
+########################
+# Database (Postgres)
+########################
+# URL koneksi Postgres untuk Prisma.
+# Contoh: postgresql://user:password@localhost:5432/raylab
+DATABASE_URL="postgresql://raylab:password@localhost:5432/raylab"
 
-# Authentik (OIDC discovery base)
-# Used by OIDC discovery and token exchange (AuthService)
-AUTHENTIK_URL=https://auth.raylab.site
+# Catatan penting: migration menggunakan fungsi UUID di migration SQL.
+# Pastikan database memiliki ekstensi yang sesuai:
+# - Jika migration menggunakan gen_random_uuid(): pasang pgcrypto
+#   SQL: CREATE EXTENSION IF NOT EXISTS pgcrypto;
+# - Jika ingin gunakan uuid_generate_v4(): pasang uuid-ossp
+#   SQL: CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\";
 
-# Authentik Admin API (provisioning identities & groups)
-# Example: https://auth.raylab.site/api
-AUTHENTIK_API_BASE=https://auth.raylab.site/api
+########################
+# Internal JWT (RayLab)
+########################
+# Secret untuk menandatangani JWT internal (hingga JwtModule digunakan).
+# Ganti dengan secret yang kuat di produksi.
+RAYLAB_JWT_SECRET="replace-with-a-strong-secret"
 
-# Bearer token for Authentik Admin API (admin service account)
-AUTHENTIK_API_TOKEN=changeme_admin_api_token
+########################
+# Authentik / OIDC (Identity Provider)
+########################
+# Issuer base URL dari Authentik / OIDC provider (wajib untuk verifikasi token)
+# Contoh: https://auth.example.com
+AUTHENTIK_ISSUER="https://auth.example.com"
 
-# Default group name format: RL-{object}
-# RayLab will use this group to gate access (default RL-RayLab-Users)
-AUTHENTIK_DEFAULT_GROUP=RL-RayLab-Users
+# Audience (aud) yang diharapkan pada token OIDC (opsional)
+AUTHENTIK_AUDIENCE="raylab"
 
-# OIDC / JWKS / Issuer settings for verifying Authentik tokens (if needed)
-AUTHENTIK_JWKS_URI=https://auth.raylab.site/.well-known/jwks.json AUTHENTIK_ISSUER=https://auth.raylab.site/application/o/ray-lab-core/ AUTHENTIK_AUDIENCE=ray-lab-core
+# JWKS URI jika ingin override. Jika kosong, akan dibentuk dari AUTHENTIK_ISSUER + "/.well-known/jwks.json"
+AUTHENTIK_JWKS_URI=""
 
-# OIDC client credentials (used when RayLab needs to call token endpoint)
-AUTHENTIK_CLIENT_ID=raylab-client AUTHENTIK_CLIENT_SECRET=raylab-client-secret
+########################
+# Redis (opsional, beberapa fitur)
+########################
+# Aktifkan/Nonaktifkan Redis (default true).
+REDIS_ENABLED="true"
 
-# RayLab internal JWT (used to sign internal tokens)
-RAYLAB_JWT_SECRET=replace_with_a_long_random_secret
+# URL Redis (contoh: redis://localhost:6379). Hanya dipakai bila REDIS_ENABLED=true
+REDIS_URL="redis://localhost:6379"
 
-# Token lifetime in seconds
-RAYLAB_JWT_EXPIRES_IN=3600
+########################
+# Server / Aplikasi
+########################
+# Base URL aplikasi (dipakai pada integration tests / helper)
+BASE_URL="http://localhost:3000"
 
-# Sync / reconciliation
-# Interval in seconds for reconciler to retry PENDING/FAILED syncs
-AUTH_RECONCILE_INTERVAL_SECONDS=3600
+# Port aplikasi
+PORT="3000"
 
-# Auth / sync behavior
-# Disable auto-creation of users on login (must remain false per design)
-AUTH_AUTO_CREATE_USER=false AUTH_SYNC_EMAIL=true AUTH_SYNC_USERNAME=false
+# Node environment
+NODE_ENV="development"
 
-# Test accounts for integration tests (must exist in Authentik and RayLab DB before tests,
-# or be provisioned via RayLab Admin endpoints during test run)
-ADMIN_USERNAME=admin@example.com ADMIN_PASSWORD=changeme_admin_password
+# Log level (debug/info/warn/error)
+LOG_LEVEL="debug"
 
-OWNER_USERNAME=owner@example.com OWNER_PASSWORD=changeme_owner_password
+########################
+# Admin / Test accounts (opsional, dipakai tests/integration jika diperlukan)
+########################
+# Akun admin untuk keperluan pengujian/integrasi (hanya contoh)
+ADMIN_USERNAME="admin"
+ADMIN_PASSWORD="changeme"
 
-EMPLOYEE_USERNAME=employee@example.com EMPLOYEE_PASSWORD=changeme_employee_password
+# Informasi akun uji (opsional)
+TEST_USER_EMAIL="test-integration@example.com"
+TEST_USER_USERNAME="test-integration"
+TEST_USER_PASSWORD="StrongP@ssw0rd!"
 
-# Optional: integration test user (overrides defaults used by tests)
-TEST_USER_EMAIL=test-integration@example.com TEST_USER_USERNAME=test-integration TEST_USER_PASSWORD=StrongP@ssw0rd!
+# Expire time for test tokens (detik)
+TEST_TOKEN_EXPIRES_IN="3600"
 
-# Optional: adjust logging or other runtime flags
-LOG_LEVEL=info
+########################
+# Optional / Integration hints
+########################
+# Jika Anda menggunakan penyedia lain atau menambahkan variabel tambahan,
+# tambahkan di sini. Contoh:
+# SSO_CALLBACK_URL="http://localhost:3000/auth/callback"
+# MAILER_* variables, STORAGE_*, dsb.
 
-SWAGGER_ENABLED=true
\ No newline at end of file
+########################
+# Security reminders
+########################
+# - Jangan commit file .env dengan secrets.
+# - Gunakan secret manager di production (Vault, AWS Secrets Manager, ..).
+# - Pastikan DATABASE_URL menunjuk ke database yang benar dan aman.
+# - Pastikan AUTHENTIK_ISSUER dan JWKS dapat diakses dari RayLab instance.
\ No newline at end of file