This lesson's interactive features are locked, please to keep using them

Protecting Secrets

Moving a secret out of source code is only the first step. Local files that contain injected secrets also need to stay out of version control.

As a general rule, environment files should be ignored by version control.

.env*
!.env.example

That said, a .env.example file is conventionally committed with dummy examples of the values the app expects in .env.

APP_ORIGIN=http://localhost:3000
TICKET_PROVIDER_KEY=replace_with_your_ticket_provider_key

Developers can copy that template into a local .env file and supply their own values.

Node.js 24 can load a file through --env-file-if-exists=.env. Adding that flag to the local dev and start scripts loads .env when it exists without making the file mandatory. Shells and production environments can simply inject the variable directly.

Assignment

Bearly Secure requires runtime configuration, but its local scripts do not load .env yet. Add a safe local environment-file workflow.

In src/dependencies.ts, replace the random startup download-signing key with a required "DOWNLOAD_SIGNING_KEY" environment variable, decoded from hex into a Buffer.

Add the following to .env.example:

PAWPAL_API_KEY=replace_with_your_pawpal_api_key
DOWNLOAD_SIGNING_KEY=replace_with_64_hex_characters
APP_ORIGIN=http://localhost:3000

Ignore all .env variants but unignore .env.example.
In package.json, update the db:reset, dev, and start scripts to load .env when it exists:
```
--env-file-if-exists=.env
```
Copy .env.example to a new .env file and replace its placeholders with valid dummy values. You can generate random hexadecimal values in your terminal:
```
openssl rand -hex 32
```
Confirm that .env is ignored by Git:
```
git check-ignore .env
```
Start the app without inline variables, confirm the local .env configuration loads successfully, and then stop it.
```
npm run dev
```

Run and submit the CLI tests from the project root.