title: Rails 6+: order in which Rails reads SECRET_KEY_BASE (env var versus credentials.yml.enc)
body: <p>For context, I'm in the process of updating a Rails app to 5.2 and then to 6.0.</p>
  
  <p>I'm updating my credentials to use the <code>config/credentials.yml.enc</code> and <code>config/master.key</code> defaults with Rails 5.2+ apps.</p>
  
  <p>The <a href="https://edgeguides.rubyonrails.org/security.html#session-storage" rel="nofollow noreferrer">Rails docs</a> state:</p>
  
  <blockquote>
    <p>In test and development applications get a secret_key_base derived from the app name. Other environments <strong>must use a random key</strong> present in <code>config/credentials.yml.enc</code>
    (emphasis added)</p>
  </blockquote>
  
  <p>This leads me to think that in production the <code>SECRET_KEY_BASE</code> value is <strong>required</strong> to be read from <code>Rails.application.credentials.secret_key_base</code> via <code>config/credentials.yml.enc</code>.  In <code>test</code> and <code>development</code> environments, the <code>secret_base_key</code> is essentially "irrelevant", since it's calculated from the app name.</p>
  
  <p>However, when I was looking at the <a href="https://github.com/rails/rails/blob/32b99f9358b828daf16236695d041288e4b2f648/activesupport/lib/active_support/encrypted_file.rb#L39" rel="nofollow noreferrer">Rails source code</a>, it reads:</p>
  
  <pre><code>def key
    read_env_key || read_key_file || handle_missing_key
  end
  </code></pre>
  
  <p>That seems to say the <strong>order</strong> of reading values is:</p>
  
  <ol>
  <li><code>ENV["SECRET_BASE_KEY"]</code></li>
  <li><code>Rails.application.credentials.secret_base_key</code></li>
  <li>Raise error</li>
  </ol>
  
  <p>I use Heroku for my hosting, and have a <code>ENV["SECRET_BASE_KEY"]</code> env variable that stores this secret value.</p>
  
  <p><strong>Questions</strong></p>
  
  <ol>
  <li>If I have <strong>both</strong> <code>ENV["SECRET_BASE_KEY"]</code> and <code>Rails.application.credentials.secret_base_key</code> set, which one takes priority?</li>
  <li>Is using the ENV var going to be deprecated at some point?</li>
  <li>I have lots of environment-specific ENV variables because I don't want to use my production accounts in development for AWS S3 buckets, stripe accounts, etc.  The flat-file format of <code>credentials.yml.enc</code> seems to assume developers only need to access these 3rd-party APIs in production. Is there an accepted format to handle environment-specific credentials yet in Rails?</li>
  </ol>
  
  <p>I read through the comment threads on DHH's <a href="https://github.com/rails/rails/pull/30067" rel="nofollow noreferrer">original PR</a> as well as a <a href="https://github.com/rails/rails/pull/33521" rel="nofollow noreferrer">linked PR</a> that says it implements environment-specific credentials, but the docs don't mention this implementation so I'm not certain if it's the standard or if it's going to go away sometime soon.</p>