diff --git a/.gitignore b/.gitignore
index 0585c04..14158ad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,10 @@ __pycache__/
 # The local flow store (its own git repository) and the encrypted secrets file.
 /backend/flow-data/
 
+# Keys, wherever a data directory lands: the engine writes oauth-key.pem into it.
+*.pem
+*.key
+
 # Output of `make verify` (root Makefile).
 /frontend/screenshots/
 *.tsbuildinfo
diff --git a/docs/code/cli.md b/docs/code/cli.md
index f0fd45b..d8219d1 100644
--- a/docs/code/cli.md
+++ b/docs/code/cli.md
@@ -110,7 +110,7 @@ restart. It is skipped if the instance is already enrolled.
 
 ```text
 Created the admin account admin@example.com
-  password: k3Qm-8vTpLdX
+  password: example-password
   Shown once. Change it from the dashboard.
 Fluksio 0.1.0 — data in /home/you/.fluksio
   API      http://127.0.0.1:8000/api/v1
diff --git a/docs/getting-started/data-science.md b/docs/getting-started/data-science.md
index 89caec9..044f447 100644
--- a/docs/getting-started/data-science.md
+++ b/docs/getting-started/data-science.md
@@ -19,7 +19,7 @@ open, and no login. The first run prints something like:
 
 ```text
 Created the admin account admin@example.com
-  password: k3Qm-8vTpLdX
+  password: example-password
   Shown once. Change it from the dashboard.
 Fluksio 0.1.0 — data in /home/you/my-research/.fluksio
   API      http://127.0.0.1:8000/api/v1
@@ -690,7 +690,7 @@ API = "http://127.0.0.1:8000/api/v1"
 api = httpx.Client(base_url=API, timeout=60)
 token = api.post(
     "/login/access-token",
-    data={"username": "admin@example.com", "password": "k3Qm-8vTpLdX"},
+    data={"username": "admin@example.com", "password": "example-password"},
 ).json()["access_token"]
 api.headers["Authorization"] = f"Bearer {token}"