This lesson's interactive features are locked, please to keep using them

Injecting Secrets at Runtime

Apps need secrets at runtime, but those secrets shouldn't live in source code. A common approach is to inject them through environment variables.

Centralizing required configuration gives every secret the same validation behavior:

func requireEnvironmentVariable(environment map[string]string, name string) (string, error) {
    value := environment[name]
    if value == "" {
        return "", fmt.Errorf("missing required environment variable: %s", name)
    }
    return value, nil
}

Read required configuration during startup. If PAWPAL_API_KEY is missing, fail immediately instead of waiting until a customer tries to check out. That's safer and easier to debug.

Secrets don't need to use environment variables, and environment variables can still be handled insecurely. The important part is that secrets are not committed to source code. Inject them when the app starts from a protected source.

Assignment

Bearly Secure uses a PawPal API key committed in its configuration package. Replace that hard-coded key with required runtime configuration.

In internal/config/config.go, add a helper that returns a required environment value or an error when it is empty.
In Parse, require PAWPAL_API_KEY and assign it to Config.PawPalAPIKey instead of using the starter key.
Start the app with a dummy key and confirm startup succeeds, then stop it.
```
PAWPAL_API_KEY=pawpal_test_local go run ./cmd/server
```

Run and submit the CLI tests from the project root.