diff --git a/trikoder/oauth2-bundle/2.0/manifest.json b/trikoder/oauth2-bundle/2.0/manifest.json
index 0ee9f4f3..0754fe29 100644
--- a/trikoder/oauth2-bundle/2.0/manifest.json
+++ b/trikoder/oauth2-bundle/2.0/manifest.json
@@ -6,6 +6,8 @@
         "config/": "%CONFIG_DIR%/"
     },
     "env": {
+        "#1": "Fallback OAuth2 encryption key",
+        "#2": "Please change this with a secure value: https://oauth2.thephpleague.com/installation/#string-password",
         "OAUTH2_ENCRYPTION_KEY": "%generate(secret)%"
     }
 }
diff --git a/trikoder/oauth2-bundle/2.0/post-install.txt b/trikoder/oauth2-bundle/2.0/post-install.txt
index 182d1126..09e96ed4 100644
--- a/trikoder/oauth2-bundle/2.0/post-install.txt
+++ b/trikoder/oauth2-bundle/2.0/post-install.txt
@@ -2,24 +2,24 @@
 <bg=blue;fg=white> OAuth2 Configuration </>
 <bg=blue;fg=white>                      </>
 
-  0. (Optional) Do one of the following
-    i)  Change the <info>OAUTH2_ENCRYPTION_KEY</> env variable: <comment>https://oauth2.thephpleague.com/installation/#string-password</>
-    ii) Configure the <info>encryption_key</> with a secure encryption key: <comment>https://oauth2.thephpleague.com/installation/#string-password</>
-
   1.
     i)   Generate a private/public key pair (preferably with a password): <comment>https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys</>
     ii)  Configure the <info>private_key and</> <info>public_key</> with the respective key locations
     iii) (Optional) Set the <info>private_key_passphrase</> to the private key password set in the previous step
 
-  2.
-    * Update the database so bundle entities can be persisted using Doctrine: <comment>bin/console doctrine:schema:update --force</>
+  2. Do one of the following
+    i)  Add the <info>OAUTH2_ENCRYPTION_KEY</> env variable in <info>.env.local</> (don't commit your production secrets): <comment>https://oauth2.thephpleague.com/installation/#string-password</>
+    ii) Configure the <info>encryption_key</> with a secure encryption key: <comment>https://oauth2.thephpleague.com/installation/#string-password</>
 
   3.
+    * Update the database so bundle entities can be persisted using Doctrine: <comment>bin/console doctrine:schema:update --force</>
+
+  4.
     * Import the routes inside your <info>config/routes.yaml</> file:
       <comment>
       oauth2:
           resource: '@TrikoderOAuth2Bundle/Resources/config/routes.xml'
       </>
 
-  4.
+  5.
     * Read the documentation at <comment>https://github.com/trikoder/oauth2-bundle/blob/master/docs/basic-setup.md</>