diff --git a/.gitignore b/.gitignore
index 2e8b4ad..7f280bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,7 @@ __pycache__/
 *.pyc
 dev-ignore/
 report.md
-eval_bundle/
\ No newline at end of file
+eval_bundle/
+
+# Secrets
+.env
\ No newline at end of file
diff --git a/dev/gen_synthetic_data.py b/dev/gen_synthetic_data.py
index 068824f..c08c7e6 100644
--- a/dev/gen_synthetic_data.py
+++ b/dev/gen_synthetic_data.py
@@ -24,8 +24,7 @@ prompt:
    manually generate any kind of entropy you can think of and include it in your prompts
    to maintain healthy and good diversity in the data.
 
-NOTE: You need OpenRouter API key in a file called "openroutertoken.txt" in the root directory of the repo.
-      (obviously you can tune this arbitrarily to your liking)
+NOTE: You need OPENROUTER_API_KEY set in .env or as an environment variable.
 NOTE: For more details see this discussion: https://github.com/karpathy/nanochat/discussions/139
 """
 import requests
@@ -34,10 +33,12 @@ import os
 import copy
 import random
 from concurrent.futures import ThreadPoolExecutor, as_completed
+from dotenv import load_dotenv
 
 from nanochat.common import get_base_dir
 
-api_key = open("openroutertoken.txt", "r", encoding="utf-8").read().strip()
+load_dotenv()
+api_key = os.environ["OPENROUTER_API_KEY"]
 
 url = "https://openrouter.ai/api/v1/chat/completions"
 headers = {
diff --git a/pyproject.toml b/pyproject.toml
index b990f72..d8a6b74 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,6 +8,7 @@ dependencies = [
     "datasets>=4.0.0",
     "fastapi>=0.117.1",
     "psutil>=7.1.0",
+    "python-dotenv>=1.2.1",
     "regex>=2025.9.1",
     "rustbpe>=0.1.0",
     "setuptools>=80.9.0",
@@ -63,4 +64,4 @@ conflicts = [
         { extra = "cpu" },
         { extra = "gpu" },
     ],
-]
\ No newline at end of file
+]
diff --git a/uv.lock b/uv.lock
index fd51d63..1e76ad6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -741,6 +741,7 @@ dependencies = [
     { name = "datasets" },
     { name = "fastapi" },
     { name = "psutil" },
+    { name = "python-dotenv" },
     { name = "regex" },
     { name = "rustbpe" },
     { name = "setuptools" },
@@ -774,6 +775,7 @@ requires-dist = [
     { name = "datasets", specifier = ">=4.0.0" },
     { name = "fastapi", specifier = ">=0.117.1" },
     { name = "psutil", specifier = ">=7.1.0" },
+    { name = "python-dotenv", specifier = ">=1.2.1" },
     { name = "regex", specifier = ">=2025.9.1" },
     { name = "rustbpe", specifier = ">=0.1.0" },
     { name = "setuptools", specifier = ">=80.9.0" },
@@ -1404,6 +1406,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
 ]
 
+[[package]]
+name = "python-dotenv"
+version = "1.2.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f0/26/19cadc79a718c5edbec86fd4919a6b6d3f681039a2f6d66d14be94e75fb9/python_dotenv-1.2.1.tar.gz", hash = "sha256:42667e897e16ab0d66954af0e60a9caa94f0fd4ecf3aaf6d2d260eec1aa36ad6", size = 44221, upload-time = "2025-10-26T15:12:10.434Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/1b/a298b06749107c305e1fe0f814c6c74aea7b2f1e10989cb30f544a1b3253/python_dotenv-1.2.1-py3-none-any.whl", hash = "sha256:b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61", size = 21230, upload-time = "2025-10-26T15:12:09.109Z" },
+]
+
 [[package]]
 name = "pytz"
 version = "2025.2"