This lesson's interactive features are locked, please to keep using them

Injecting Secrets at Runtime

Apps need secrets at runtime, but those secrets shouldn't live in source code. A common approach is to inject them through environment variables.

Your code should typically centralize access to environment variables. A small helper gives every required value the same validation behavior:

export function requireEnv(name: string): string {
  const value = process.env[name];
  if (!value) {
    throw new Error(`Missing required environment variable: ${name}`);
  }
  return value;
}

export const ticketProviderKey = requireEnv("TICKET_PROVIDER_KEY");

You should read required configuration during startup. If TICKET_PROVIDER_KEY is missing, fail immediately instead of waiting to fail when a customer tries to buy a ticket. That's safer and easier to debug.

To be clear, secrets don't need to use environment variables, and environment variables can still be handled insecurely. The important part is that secrets are not committed to source code. Inject them when the app starts from a protected source.

Assignment

Bearly Secure signs PawPal references with a key committed directly in src/integrations/pawpal.ts. Replace that hard-coded key with required runtime configuration.

In src/dependencies.ts, implement a helper function for reading required environment variables.
Add a pawPalApiKey field to the Dependencies type.
Load "PAWPAL_API_KEY" during startup.
In src/integrations/pawpal.ts, remove the hardcoded pawPalApiKey.
Update createPawPalReference to accept an API key string as the final parameter.
In src/routes/checkout.ts, pass the PawPal API key to createPawPalReference in the POST /checkout route handler.

Start the app and pass it a dummy api key.

PAWPAL_API_KEY=pawpal_test_local npm run dev

Confirm startup succeeds, and then stop it.

Run and submit the CLI tests from the project root.