Add note about lockbox config

README.md

@@ -28,6 +28,10 @@ To use the application the Google API client needs to be configured using the fo
 
 You can get those from the [Google APIs Dashboard](https://console.developers.google.com/apis/dashboard)
 
+Additionally an encryption master key needs to be configured. [lockbox](https://github.com/ankane/lockbox) is used to encrypt sensitive data (e.g. access_token) at rest.
+
+* LOCKBOX_MASTER_KEY
+
 Store those in a `.env` file; see `env.example` for an example.
 
 ### Run the application