# API Keys in Dotenv Files — Status

**Last Updated:** 2026-02-05  
**Purpose:** Which required API keys (from [API_KEYS_REQUIRED.md](../../reports/API_KEYS_REQUIRED.md)) are **contained** in at least one `.env` / `.env.example` file vs **not contained**.  
**Note:** This report lists variable names and file paths only; it does not report or recommend exposing actual secret values.

---

## Contained (variable present in at least one dotenv file)

| Variable | File(s) where defined or referenced |
|----------|-------------------------------------|
| **LIFI_API_KEY** | `alltra-lifi-settlement/.env`, `.env.example` (root) |
| **JUMPER_API_KEY** | `alltra-lifi-settlement/.env`, `.env.example` (root) |
| **ONEINCH_API_KEY** | `.env.example` (root), `explorer-monorepo/deployment/ENVIRONMENT_TEMPLATE.env` |
| **MOONPAY_API_KEY** | `.env.example` (root), `explorer-monorepo/deployment/ENVIRONMENT_TEMPLATE.env` |
| **RAMP_NETWORK_API_KEY** | `.env.example` (root) |
| **ONRAMPER_API_KEY** | `.env.example` (root) |
| **ETHERSCAN_API_KEY** | `.env.example` (root), `smom-dbis-138/.env`, `smom-dbis-138/.env.example`, `smom-dbis-138/terraform/phases/phase1/.env.mainnet`, `smom-dbis-138/frontend-dapp/.env.example` (as VITE_ETHERSCAN_API_KEY), token-aggregation (via smom), backups, explorer-monorepo |
| **COINGECKO_API_KEY** | `.env`, `.env.example` (root), `smom-dbis-138/services/token-aggregation/.env`, `smom-dbis-138/services/token-aggregation/.env.example` |
| **COINMARKETCAP_API_KEY** | `smom-dbis-138/services/token-aggregation/.env`, `smom-dbis-138/services/token-aggregation/.env.example` |
| **CLOUDFLARE_API_TOKEN** | `.env.example` (root), `scripts/update-all-dns-to-public-ip.env.example`, `explorer-monorepo/deployment/ENVIRONMENT_TEMPLATE.env` |
| **CLOUDFLARE_EMAIL** | `.env`, `.env.example` (root), `scripts/update-all-dns-to-public-ip.env.example` |
| **CLOUDFLARE_API_KEY** | `.env`, `.env.example` (root), `scripts/update-all-dns-to-public-ip.env.example` |
| **ALERT_SLACK_WEBHOOK_URL** | `smom-dbis-138/.env.alerts` (same use-case as SLACK_WEBHOOK_URL) |
| **SLACK_WEBHOOK** | `config/production/.env.production.example`, `backups/.../config/production/.env.production.example` |
| **PAGERDUTY_KEY** / **PAGERDUTY_ENABLED** | `config/production/.env.production.example`, `backups/.../config/production/.env.production.example` (similar to PAGERDUTY_INTEGRATION_KEY) |

---

## Now contained (added to .env.example 2026-02-05)

| Variable | File(s) |
|----------|---------|
| **MOONPAY_SECRET_KEY** | `.env.example` (root) |
| **E_SIGNATURE_BASE_URL** | `.env.example` (root), `the-order/services/legal-documents/.env.example` |
| **E_FILING_ENABLED** | `the-order/services/legal-documents/.env.example` |
| **SLACK_WEBHOOK_URL** | `.env.example` (root), `dbis_core/.env.example` |
| **PAGERDUTY_INTEGRATION_KEY** | `.env.example` (root), `dbis_core/.env.example` |
| **EMAIL_ALERT_API_URL** | `.env.example` (root), `dbis_core/.env.example` |
| **EMAIL_ALERT_RECIPIENTS** | `.env.example` (root), `dbis_core/.env.example` |
| **CRYPTO_COM_API_KEY** | `.env.example` (root), `dbis_core/.env.example` |
| **CRYPTO_COM_API_SECRET** | `.env.example` (root), `dbis_core/.env.example` |

## Not contained (no dotenv placeholder yet)

| Variable | Where needed |
|----------|--------------|
| **LayerZero** (config/API) | Bridge integrations |
| **Wormhole** (API key) | Bridge integrations |

---

## Summary

- **Contained:** All keys from API_KEYS_REQUIRED except LayerZero and Wormhole now have at least one .env.example placeholder (root and/or service-specific). Obtaining actual key values remains an operator task.
- **Not contained:** LayerZero, Wormhole (add LAYERZERO_* / WORMHOLE_* to .env.example when integrating).

**Recommendation:** Add the “not contained” variables to the appropriate `.env.example` (e.g. dbis_core, the-order, metamask-integration) with empty or placeholder values so operators know to set them. Do not commit real secrets in .env files.