diff --git a/client/.env.example b/client/.env.example
index 21f8964..a7468af 100644
--- a/client/.env.example
+++ b/client/.env.example
@@ -25,7 +25,7 @@ COOKIE_SECRET=development-secret-at-least-32-chars!!
 
 # Private JWK for confidential OAuth client (optional)
 # For production, you can generate a key pair with:
-#   npx @atproto/jwk-cli generate --alg ES256
+#   npm run gen-keys
 # Then paste the private key JSON here (minified, single line)
 # Leave empty to use public client mode (simpler, works for most cases)
 ATPROTO_JWK_PRIVATE=
diff --git a/client/package.json b/client/package.json
index 8d99e9b..ce11b6c 100644
--- a/client/package.json
+++ b/client/package.json
@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "scripts": {
+    "gen-keys": "scripts/generate-jwk.js",
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
diff --git a/client/scripts/generate-jwk.js b/client/scripts/generate-jwk.js
old mode 100644
new mode 100755