diff --git a/README.md b/README.md
index eb7f239..9696294 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,55 @@ nlc run --enrich-only
 
 Tokens are persisted locally under `~/.nlc` and must not be committed.
 
+## Collect Google Credentials
+
+`nlc` uses OAuth desktop-app credentials because it runs locally and opens a browser for user authorization. You can use one Google Cloud project for both Gmail and Sheets.
+
+1. Create or select a Google Cloud project at <https://console.cloud.google.com/>.
+2. Enable the APIs you plan to use:
+   - Gmail API: <https://console.cloud.google.com/apis/library/gmail.googleapis.com>
+   - Google Sheets API: <https://console.cloud.google.com/apis/library/sheets.googleapis.com>
+3. Configure the OAuth consent screen:
+   - Go to **Google Auth platform > Branding**.
+   - Click **Get started** if the auth platform is not configured yet.
+   - Enter an app name such as `Newsletter Link Catalog`.
+   - Use your own email for user support and developer contact.
+   - For personal use, choose **External** and add your Google account as a test user under **Audience**. For a Google Workspace-only internal tool, choose **Internal** if available.
+4. Create the desktop OAuth client:
+   - Go to **Google Auth platform > Clients**.
+   - Click **Create client**.
+   - Choose **Application type > Desktop app**.
+   - Name it `Newsletter Link Catalog Local CLI`.
+   - Click **Create**, then immediately download the JSON file.
+5. Save the downloaded JSON file locally:
+   - For Gmail reads, save it as `~/.nlc/gmail-credentials.json`.
+   - For Google Sheets writes, either copy the same OAuth JSON to `~/.nlc/sheets-credentials.json` or point both config values to the same file.
+   - On Windows, `~/.nlc` means `C:\Users\<you>\.nlc`.
+6. Keep the JSON private. Do not commit it, paste it into issues, or share it. Google notes that OAuth client secrets may only be downloadable at creation time for newer clients; if you lose the secret, rotate or recreate the client.
+
+On first live use, `nlc` opens a browser consent screen and writes token files such as `~/.nlc/gmail-token.json` and `~/.nlc/sheets-token.json`. Those token files are also secrets.
+
+### Google Sheets Destination
+
+Create the target spreadsheet in Google Sheets and copy its spreadsheet ID from the URL:
+
+```text
+https://docs.google.com/spreadsheets/d/SPREADSHEET_ID/edit
+```
+
+Put that value in `output.sheets_api.spreadsheet_id` when Sheets output is enabled. The Google account you authorize in the browser must have edit access to that spreadsheet.
+
+### Optional LLM Provider Keys
+
+LLM categorization is BYOK. Set the environment variable named in `categories.llm.api_key_env`, for example:
+
+```powershell
+$env:ANTHROPIC_API_KEY = "sk-ant-..."
+$env:OPENAI_API_KEY = "sk-..."
+```
+
+For local providers such as Ollama or LM Studio, set `categories.llm.provider` to `local` or `openai-compatible` and configure `categories.llm.base_url`; no cloud API key is required unless that endpoint requires one.
+
 ## Configuration
 
 Start from [config.example.yaml](config.example.yaml). The important choices are: