{"record":{"id":"d4ee9ea9d1f004f1","repo":"nautechsystems/nautilus_trader","slug":"signer-private-key-environment-variable-is-no","errorCode":null,"errorMessage":"Signer private key environment variable '{}' is not set","messagePattern":"Signer private key environment variable '(.+?)' is not set","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/adapters/blockchain/src/execution/client.rs","lineNumber":2777,"sourceCode":"        } else {\n            log::warn!(\n                \"No Postgres cache database configured; transactions will be refused (no durable store)\"\n            );\n        }\n\n        // Verify the RPC chain ID against configuration before any signature\n        let expected_chain_id = u64::from(self.chain.chain_id);\n        let actual_chain_id = self.http_rpc_client.chain_id().await?;\n        if actual_chain_id != expected_chain_id {\n            anyhow::bail!(\n                \"Chain ID mismatch at connect: expected {expected_chain_id}, node reported {actual_chain_id}\"\n            );\n        }\n\n        // Load the signer key from the configured environment variable; the key is never\n        // logged, serialized, or stored in configuration\n        let private_key = std::env::var(&self.config.signer_private_key_env).map_err(|_| {\n            anyhow::anyhow!(\n                \"Signer private key environment variable '{}' is not set\",\n                self.config.signer_private_key_env\n            )\n        })?;\n        let signer = PrivateKeySigner::from_str(private_key.trim()).map_err(|_| {\n            anyhow::anyhow!(\n                \"Signer private key in '{}' is not a valid hex private key\",\n                self.config.signer_private_key_env\n            )\n        })?;\n\n        if signer.address() != self.wallet_address {\n            anyhow::bail!(\n                \"Signer address {} derived from '{}' does not match configured wallet address {}\",\n                signer.address(),\n                self.config.signer_private_key_env,\n                self.wallet_address\n            );","sourceCodeStart":2759,"sourceCodeEnd":2795,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/2114cf6f761429e0adb5ca9596fcd7b895b16011/crates/adapters/blockchain/src/execution/client.rs#L2759-L2795","documentation":"During connect (client.rs:2775) the signer key is read from the environment variable named by config.signer_private_key_env. This error means that variable is not set in the process environment. The key is deliberately never stored in configuration, so a missing env var stops connect before any signature is attempted.","triggerScenarios":"Running under systemd/docker/k8s where the variable was not injected into the unit/compose/pod spec; the variable name in signer_private_key_env does not match what was exported (case-sensitive); the var set in an interactive shell but not in the service environment.","commonSituations":"Deploying to a new environment without replicating secrets; renaming the env var in config without updating the secret store; CI runs lacking the secret.","solutions":["Check the exact name in the error message and verify with printenv / env | grep <NAME> in the same context the process runs.","Export or inject the variable into the service environment (secret manager, systemd Environment=, compose env_file).","Never place the key value in config files; keep the config pointing at the variable name.","Add a startup preflight that fails fast with a clear message if the variable is absent."],"exampleFix":"# before\nexport PRIVATE_KEY=... # but config expects SIGNER_KEY\n\n# after\n# signer_private_key_env = \"SIGNER_KEY\"\nexport SIGNER_KEY=0x...  # 32-byte hex private key","handlingStrategy":"validation","validationCode":"// startup preflight:\nlet key = std::env::var(&config.signer_private_key_env)\n    .unwrap_or_else(|_| panic!(\"env var '{}' must be set before start\", config.signer_private_key_env));","typeGuard":"fn signer_env_is_set(name: &str) -> bool { std::env::var(name).is_ok() }","tryCatchPattern":"Fail startup immediately with the variable name; no retry is useful until the environment is fixed.","preventionTips":["Inject secrets via the platform's secret mechanism (systemd Environment=, compose env_file, k8s secrets).","Add a deployment checklist item verifying the signer variable in the exact runtime context."],"tags":["secrets","environment-variables","startup","signer"],"backgroundTag":"missing-env-var","analyzedSha":"2114cf6f761429e0adb5ca9596fcd7b895b16011","analyzedAt":"2026-08-21T11:28:30.864Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}