diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..2a9375f
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,4 @@
+# Copy this file to .env and fill in the values.
+# .env is git-ignored and must never be committed.
+
+XFAY_APP_SECRET=
diff --git a/.gitignore b/.gitignore
index cb3e7cf..343b624 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 .dart_tool/
+.env
diff --git a/test/file_upload_integration_test.dart b/test/file_upload_integration_test.dart
index cede0a9..ca3dbf8 100644
--- a/test/file_upload_integration_test.dart
+++ b/test/file_upload_integration_test.dart
@@ -6,28 +6,29 @@ import 'dart:typed_data';
 import 'package:swarm/swarm.dart';
 import 'package:test/test.dart';
 
+import 'test_env.dart';
+
 // Well-known test key — obviously not a real user key.
 const _privKey =
     '0000000000000000000000000000000000000000000000000000000000000001';
 
-// Per-app credentials for the xfay app.
-// ignore: avoid_hardcoded_credentials (test-only, not a user secret)
 const _kAppName = 'xfay';
-const _kAppSecret =
-    'REDACTED';
 
 // Minimal valid JPEG (SOI marker only — enough for R2 to store).
 final _kTestBytes = Uint8List.fromList([0xFF, 0xD8, 0xFF, 0xD9]);
 const _kContentType = 'image/jpeg';
 
 void main() {
+  final env = loadEnv();
+  final appSecret = env['XFAY_APP_SECRET'] ?? '';
+
   late FileUploadActor actor;
 
   setUp(() {
     actor = FileUploadActor(
       privateKey: _privKey,
       appName: _kAppName,
-      appSecret: _kAppSecret,
+      appSecret: appSecret,
     );
   });
 
diff --git a/test/test_env.dart b/test/test_env.dart
new file mode 100644
index 0000000..2e7a72d
--- /dev/null
+++ b/test/test_env.dart
@@ -0,0 +1,18 @@
+import 'dart:io';
+
+/// Loads KEY=VALUE pairs from a `.env` file at the project root.
+/// Lines starting with `#` and blank lines are ignored.
+/// Returns an empty map if the file does not exist.
+Map<String, String> loadEnv() {
+  final file = File('.env');
+  if (!file.existsSync()) return {};
+  final result = <String, String>{};
+  for (final line in file.readAsLinesSync()) {
+    final trimmed = line.trim();
+    if (trimmed.isEmpty || trimmed.startsWith('#')) continue;
+    final idx = trimmed.indexOf('=');
+    if (idx < 1) continue;
+    result[trimmed.substring(0, idx).trim()] = trimmed.substring(idx + 1).trim();
+  }
+  return result;
+}