diff --git a/README.md b/README.md
index 0e2caa9..a6f8b5c 100644
--- a/README.md
+++ b/README.md
@@ -96,7 +96,9 @@ The command line to run `google_auth_proxy` would look like this:
    --client-secret=...
 ```
 
+## Environment variables
 
+The environment variables `google_auth_client_id`, `google_auth_secret` and `google_auth_cookie_secret` can be used in place of the corresponding command-line arguments.
 
 ## Endpoint Documentation
 
diff --git a/main.go b/main.go
index 5d6cf67..7cf5777 100644
--- a/main.go
+++ b/main.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log"
 	"net"
+	"os"
 	"net/http"
 	"net/url"
 	"strings"
@@ -32,8 +33,20 @@ func init() {
 }
 
 func main() {
+
 	flag.Parse()
 
+	// Try to use env for secrets if no flag is set
+	if *clientID == "" {
+		*clientID = os.Getenv("google_auth_client_id")
+	}
+	if *clientSecret == "" {
+		*clientSecret = os.Getenv("google_auth_secret")
+	}
+	if *cookieSecret == "" {
+		*cookieSecret = os.Getenv("google_auth_cookie_secret")
+	}
+
 	if *showVersion {
 		fmt.Printf("google_auth_proxy v%s\n", VERSION)
 		return