diff --git a/AMPLIFY_DEPLOY.md b/AMPLIFY_DEPLOY.md
index 4d6006b..6d942d7 100644
--- a/AMPLIFY_DEPLOY.md
+++ b/AMPLIFY_DEPLOY.md
@@ -56,6 +56,13 @@ Add each variable to the page indicated below:
 | `CIVI_HTTP_AUTH_PASS` | **Secrets** | Only if above set |
 | `HEALTH_TOKEN` | **Secrets** | Optional; gates `/api/health` in production |
 | `PREVIEW_ADMIN_TOKEN` | **Secrets** | Optional; gates `/api/preview-link` |
+| `STAFF_REPORT_KEY` | **Secrets** | Shared secret for `/staff/report` and `/api/staff/file` |
+
+**`STAFF_REPORT_KEY`** — shared secret guarding the internal staff report
+at `/staff/report` and the file proxy at `/api/staff/file`. Store in
+Amplify SSM Parameter Store next to the `CIVI_*` secrets. Rotate by
+changing the env value; all live links must be updated. Anyone with the
+secret can view any organization's full activity history.
 
 Rule of thumb: if leaking the value would let someone impersonate the app
 to CiviCRM, or bypass a gate, it goes in **Secrets**. Hostnames and
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 66a1523..978c6e5 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -29,6 +29,7 @@ Verify all of the above against your live CiviCRM by hitting `/api/health` (in d
    | `CIVI_HTTP_AUTH_PASS` | only if CIVI_HTTP_AUTH_USER is set | HTTP Basic Auth password. |
    | `HEALTH_TOKEN` | recommended | Long random string (e.g. `openssl rand -hex 32`). Required to access `/api/health` in production. If unset, that route returns 404. |
    | `PUBLIC_ORIGIN` | optional | e.g. `https://survey.fci.coop` — used in absolute self-links if needed later. |
+   | `STAFF_REPORT_KEY` | recommended | Shared secret guarding the internal staff report at `/staff/report` and the file proxy at `/api/staff/file`. Store alongside the `CIVI_*` secrets. Rotate by changing the env value; all live links must be updated. Anyone with the secret can view any organization's full activity history. |
 
 3. **Trigger the first deploy.** Render will run `npm ci && npm run build` then `npm run start`. The platform health check hits `/healthz` (lightweight, no Civi dependency).