diff --git a/README.md b/README.md
index 917b0a9..bd074eb 100644
--- a/README.md
+++ b/README.md
@@ -6,13 +6,35 @@ This repo contains samples for running [Playwright](https://playwright.dev/docs/
 ## Setup
 
 * Clone the repo `git clone https://github.com/browserstack/browserstack-playwright-load-testing-sample.git`.
-* Set `BROWSERSTACK_USERNAME` and `BROWSERSTACK_ACCESS_KEY` as environment variables with your [BrowserStack Username and Access Key](https://www.browserstack.com/accounts/settings) 
+* Set your credentials as environment variables, as described in [Set your credentials](#set-your-credentials).
 * Run `npm i` to install the dependencies.
-* Update the same in `browserstack-load.yaml` file.
+* Open `browserstack-load.yml` and update it with your load test configuration.
+
+## Set your credentials
+
+The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from:
+
+On macOS or Linux (bash or zsh), run the lines below. The second one prompts for the key without echoing it, so the key stays out of your shell history:
+
+```sh
+export BROWSERSTACK_USERNAME="<your-username>"
+printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo; export BROWSERSTACK_ACCESS_KEY
+```
+
+On Windows, run these in PowerShell. The second line prompts for the key in the same way:
+
+```powershell
+$env:BROWSERSTACK_USERNAME = "<your-username>"
+$env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password
+```
+
+These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from.
+
+**Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings.
 
 ## Running your tests
 
-- To run the sample tests in parallel across the platforms specified in the `browserstack-load.yaml`, run `npx browserstack-cli load run`.
+- To run the sample tests in parallel across the platforms specified in the `browserstack-load.yml`, run `npx browserstack-cli load run`.
 
 ## Notes
 * You can view your test results on the [BrowserStack Load-Testing dashboard](https://load.browserstack.com/projects)
diff --git a/browserstack-load.yml b/browserstack-load.yml
index 08b44a7..b126f29 100644
--- a/browserstack-load.yml
+++ b/browserstack-load.yml
@@ -1,7 +1,8 @@
 # =============================
 # Set BrowserStack Credentials
 # =============================
-# Add your BrowserStack userName and accessKey here or set BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY as env variables.
+# Set BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY as env variables. They override the placeholders below.
+# Do not paste your real access key into this file: it is easy to commit and push by mistake.
 userName: BROWSERSTACK_USERNAME
 accessKey: BROWSERSTACK_ACCESS_KEY