diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f3ad362..836ba35 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -70,7 +70,7 @@ jobs:
           PORT: '8080'
           AUTH_SERVER_URL: http://localhost:5312
           AUTH_SERVER_ISSUER: http://auth-api:5312
-          API_SERVICE_TOKEN: verify-dev-service-token-not-a-real-secret
+          SEAMLESS_SERVICE_TOKEN: verify-dev-service-token-not-a-real-secret
           COOKIE_SIGNING_KEY: verify-dev-service-token-not-a-real-secret
           JWKS_KID: dev-main
         run: |
diff --git a/README.md b/README.md
index c84aef3..72d2c58 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ use serde_json::json;
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let auth = Adapter::builder(std::env::var("AUTH_SERVER_URL")?)
         .cookie_secret(std::env::var("COOKIE_SECRET")?) // at least 32 bytes
-        .service_secret(std::env::var("SERVICE_SECRET")?) // the API's API_SERVICE_TOKEN
+        .service_secret(std::env::var("SEAMLESS_SERVICE_TOKEN")?) // same value as the API's API_SERVICE_TOKEN
         .jwks_kid(std::env::var("JWKS_KID")?)
         .build()?;
 
@@ -60,6 +60,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 }
 ```
 
+The auth server reads the service token from `API_SERVICE_TOKEN` and your app reads it from
+`SEAMLESS_SERVICE_TOKEN`; both hold the same value.
+
 Serve with `into_make_service_with_connect_info::<SocketAddr>()`. Without it the adapter has no
 peer address and forwards no client address to the auth API.
 
@@ -93,7 +96,7 @@ JSON it would be a sign-in the user never made. The client SDKs already send JSO
 | `auth_server_issuer` | the URL | Expected `iss` of the API's tokens, when it differs from the URL you reach it at |
 | `audience` | the issuer | Expected `aud` of the API's tokens |
 | `cookie_secret` | required | Signs the session cookies (32 bytes or more) |
-| `service_secret` | required | The API's `API_SERVICE_TOKEN` (32 bytes or more) |
+| `service_secret` | required | The service token, read from `SEAMLESS_SERVICE_TOKEN` in the examples; the same value as the API's `API_SERVICE_TOKEN` (32 bytes or more) |
 | `jwks_kid` | `dev-main` | `kid` header on service tokens |
 | `cookie_domain` | none | Cookie `Domain` |
 | `insecure_cookies` | `false` | Drops `Secure`, for local development over HTTP |
@@ -180,7 +183,7 @@ Docker, a checkout of `seamless-auth-api` and the `seamless` CLI:
 
 ```bash
 PORT=8080 AUTH_SERVER_URL=http://localhost:5312 AUTH_SERVER_ISSUER=http://auth-api:5312 \
-  API_SERVICE_TOKEN=verify-dev-service-token-not-a-real-secret \
+  SEAMLESS_SERVICE_TOKEN=verify-dev-service-token-not-a-real-secret \
   COOKIE_SIGNING_KEY=verify-dev-service-token-not-a-real-secret JWKS_KID=dev-main \
   cargo run --example refapp &
 
diff --git a/conformance/refapp/main.rs b/conformance/refapp/main.rs
index d8596c6..63115fe 100644
--- a/conformance/refapp/main.rs
+++ b/conformance/refapp/main.rs
@@ -23,7 +23,7 @@ async fn main() {
     let auth = Adapter::builder(env("AUTH_SERVER_URL"))
         .auth_server_issuer(env("AUTH_SERVER_ISSUER"))
         .cookie_secret(env("COOKIE_SIGNING_KEY"))
-        .service_secret(env("API_SERVICE_TOKEN"))
+        .service_secret(env("SEAMLESS_SERVICE_TOKEN"))
         .jwks_kid(env("JWKS_KID"))
         .deliver(move |d: Delivery| {
             let sink = sink.clone();
diff --git a/src/lib.rs b/src/lib.rs
index 2911290..11db361 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -13,7 +13,7 @@
 //! # async fn run() -> Result<(), Box<dyn std::error::Error>> {
 //! let auth = Adapter::builder(std::env::var("AUTH_SERVER_URL")?)
 //!     .cookie_secret(std::env::var("COOKIE_SECRET")?)
-//!     .service_secret(std::env::var("SERVICE_SECRET")?)
+//!     .service_secret(std::env::var("SEAMLESS_SERVICE_TOKEN")?)
 //!     .jwks_kid(std::env::var("JWKS_KID")?)
 //!     .build()?;
 //!
diff --git a/src/options.rs b/src/options.rs
index 6e42001..9ae7e5d 100644
--- a/src/options.rs
+++ b/src/options.rs
@@ -154,8 +154,9 @@ impl Builder {
         self
     }
 
-    /// Signs the service tokens the auth API trusts this adapter by. It is the
-    /// API's `API_SERVICE_TOKEN`. At least 32 bytes. Required.
+    /// Signs the service tokens the auth API trusts this adapter by. It holds the
+    /// same value as the API's `API_SERVICE_TOKEN`; apps conventionally read it
+    /// from `SEAMLESS_SERVICE_TOKEN`. At least 32 bytes. Required.
     pub fn service_secret(mut self, secret: impl Into<String>) -> Self {
         self.service_secret = secret.into();
         self