diff --git a/backend/.env.example b/backend/.env.example
index cc0bd94..7b3798e 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -4,10 +4,13 @@ DATABASE_URL=postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db
 # Redis
 REDIS_URL=redis://localhost:6379/0
 
-# JWT
-SECRET_KEY=change-me-to-a-secure-random-string
-ALGORITHM=HS256
-ACCESS_TOKEN_EXPIRE_MINUTES=30
+# JWT / Auth
+ALGORITHM=RS256
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+REFRESH_TOKEN_EXPIRE_DAYS=30
+# Directory where the RSA keypair is loaded/generated at runtime.
+# Defaults to ~/.agp/keys (outside the repo). Keys are never committed to git.
+RSA_KEY_DIR=~/.agp/keys
 
 # App
 APP_NAME=AGP Backend
diff --git a/backend/app/models/session.py b/backend/app/models/session.py
index 4b8d3ea..8fe773b 100644
--- a/backend/app/models/session.py
+++ b/backend/app/models/session.py
@@ -26,7 +26,9 @@ class RefreshToken(Base):
 
     id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
     user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
-    token = Column(String(512), unique=True, index=True, nullable=False)
+    # RS256 JWTs are ~420+ chars; Text avoids length issues and is fine for
+    # a UUID-indexed lookup by hash in the future.
+    token = Column(String, unique=True, index=True, nullable=False)
     expires_at = Column(DateTime(timezone=True), nullable=False)
     is_active = Column(Boolean, default=True)
     created_at = Column(DateTime(timezone=True), server_default=func.now())