diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..7571fe4
--- /dev/null
+++ b/.env.example
@@ -0,0 +1 @@
+TYPESAFE_API_KEY=
diff --git a/README.md b/README.md
index ee45fc4..8de459b 100644
--- a/README.md
+++ b/README.md
@@ -5,18 +5,26 @@ niciun produs; e doar pentru a invata API-ul si a proba pe date reale.
 
 ## Rulare
 
+Pune cheia in `.env` (o linie, fara ghilimele):
+
+```
+TYPESAFE_API_KEY=cheia_ta
+```
+
+apoi:
+
 ```sh
-export TYPESAFE_API_KEY=cheia_ta     # Git Bash
-# set TYPESAFE_API_KEY=cheia_ta      # cmd
 python typesafe_test.py
 ```
 
-Cheia sta doar in mediu — nu se scrie in fisierele de aici.
+`.env` e in `.gitignore` — nu pleaca niciodata pe git. `.env.example` e sablonul
+versionat. Daca `TYPESAFE_API_KEY` exista in mediu, are prioritate peste `.env`.
 
 ## Ce e in folder
 
 | | |
 |---|---|
+| `.env` / `.env.example` | cheia API, neversionata / sablon |
 | `typesafe_test.py` | un apel, cate o intrebare din fiecare tip, pe o linie de factura de furnizor. Modifica `state` si `criteria` pe cazuri reale. |
 | `docs/` | documentatia oficiala, descarcata ca Markdown (111 pagini) |
 | `update_docs.sh` | reia docs-urile cand se schimba |
diff --git a/typesafe_test.py b/typesafe_test.py
index 7b9436a..d4296ee 100644
--- a/typesafe_test.py
+++ b/typesafe_test.py
@@ -1,10 +1,25 @@
 # Test TypeSafe System One - stdlib, fara dependinte.
-# Rulare:  set TYPESAFE_API_KEY=...   apoi:  python typesafe_test.py
-import json, os, sys, urllib.request
+# Rulare:  pune cheia in .env  apoi:  python typesafe_test.py
+import io, json, os, sys, urllib.request
 
-KEY = os.environ.get("TYPESAFE_API_KEY")
-if not KEY:
-    sys.exit("Lipseste TYPESAFE_API_KEY in mediu.")
+
+def cheie():
+    """Din mediu daca e setata, altfel din .env de langa script."""
+    k = os.environ.get("TYPESAFE_API_KEY")
+    if k:
+        return k
+    env = os.path.join(os.path.dirname(os.path.abspath(__file__)), ".env")
+    if os.path.exists(env):
+        for linie in io.open(env, encoding="utf-8"):
+            linie = linie.strip()
+            if linie.startswith("TYPESAFE_API_KEY="):
+                return linie.split("=", 1)[1].strip().strip("'\"")
+    return None
+
+
+KEY = cheie()
+if not KEY or KEY == "pune_cheia_aici":
+    sys.exit("Lipseste cheia: pune-o in .env (TYPESAFE_API_KEY=...) sau in mediu.")
 
 # state = ce vede modelul. Aici: o linie de factura de furnizor + candidatii scosi "din Oracle".
 payload = {