diff --git a/README.md b/README.md
index 45f7492..08c6f27 100644
--- a/README.md
+++ b/README.md
@@ -81,6 +81,31 @@ On the Config Detail page, click **Generate Config**:
 
 ---
 
+## Command-Line Download
+
+Each config has a **Download Token** — a secret string that allows downloading the generated ZIP without an OIDC session. This is useful for automation scripts and CI pipelines.
+
+### Finding your token
+
+Open a config in the UI. The **Download Token** field is shown above the tabs. Click the copy icon to copy it.
+
+### Downloading via curl
+
+```bash
+curl -X POST "https://<host>/api/configs/<config-id>/generate?format=zip" \
+  -H 'Content-Type: application/json' \
+  -d '{"token": "<your-download-token>"}' \
+  -o shorewall.zip
+```
+
+Replace `<config-id>` with the numeric ID visible in the URL when you open a config (e.g. `/configs/1`).
+
+### Rotating the token
+
+Click the **Regenerate** button (⟳) next to the token field. The old token is immediately invalidated. You will need to update any scripts that use it.
+
+---
+
 ## API Documentation
 
 FastAPI generates interactive docs automatically: