Prefer --api-key over STRIPE_API_KEY

pkg/cmd/whoami.go

@@ -184,10 +184,13 @@ func resolveKeyInfo(profile *config.Profile, livemode bool) whoamiKeyInfo {
 // command, if any. These are the sources that GetAPIKey checks before the
 // persisted config/keyring, and which are mode-agnostic in that function.
 func overrideAPIKey(profile *config.Profile) string {
+	if profile.APIKey != "" {
+		return profile.APIKey
+	}
 	if key := os.Getenv("STRIPE_API_KEY"); key != "" {
 		return key
 	}
-	return profile.APIKey
+	return ""
 }
 
 // apiKeyIsLivemode reports whether a key's prefix indicates live mode.

pkg/cmd/whoami_test.go

@@ -130,6 +130,29 @@ func TestWhoamiWithEnvVarKey(t *testing.T) {
 	assert.False(t, result.LiveModeKey.Available)
 }
 
+func TestWhoamiFlagKeyTakesPrecedenceOverEnvVar(t *testing.T) {
+	config.KeyRing = keyring.NewArrayKeyring([]keyring.Item{})
+	t.Setenv("STRIPE_API_KEY", "sk_test_envvar1234567890")
+
+	wc := newWhoamiCmd()
+	wc.profile = &config.Profile{
+		ProfileName: "default",
+		DeviceName:  "test-device",
+		APIKey:      "rk_live_flag1234567890",
+	}
+	wc.format = "json"
+
+	out, err := runWhoami(t, wc)
+	require.NoError(t, err)
+
+	var result whoamiOutput
+	require.NoError(t, json.Unmarshal([]byte(out), &result))
+
+	assert.True(t, result.Authenticated)
+	assert.False(t, result.TestModeKey.Available)
+	assert.True(t, result.LiveModeKey.Available)
+}
+
 func TestAPIKeyIsLivemode(t *testing.T) {
 	assert.False(t, apiKeyIsLivemode("sk_test_abc123"))
 	assert.True(t, apiKeyIsLivemode("sk_live_abc123"))

pkg/config/profile.go

@@ -219,23 +219,23 @@ func (p *Profile) GetAccountID() (string, error) {
 
 // GetAPIKey will return the existing key for the given profile
 func (p *Profile) GetAPIKey(livemode bool) (string, error) {
-	envKey := os.Getenv("STRIPE_API_KEY")
-	if envKey != "" {
-		err := validators.APIKey(envKey)
+	if p.APIKey != "" {
+		err := validators.APIKey(p.APIKey)
 		if err != nil {
 			return "", err
 		}
 
-		return envKey, nil
+		return p.APIKey, nil
 	}
 
-	if p.APIKey != "" {
-		err := validators.APIKey(p.APIKey)
+	envKey := os.Getenv("STRIPE_API_KEY")
+	if envKey != "" {
+		err := validators.APIKey(envKey)
 		if err != nil {
 			return "", err
 		}
 
-		return p.APIKey, nil
+		return envKey, nil
 	}
 
 	var key string

pkg/config/profile_test.go

@@ -283,6 +283,28 @@ func TestLiveModeAPIKeyKeychainItemReplaced(t *testing.T) {
 	cleanUp(c.ProfilesFile)
 }
 
+func TestGetAPIKeyFlagTakesPrecedenceOverEnvVar(t *testing.T) {
+	t.Setenv("STRIPE_API_KEY", "sk_test_envvar1234567890")
+
+	p := Profile{
+		APIKey: "rk_live_flag1234567890",
+	}
+
+	key, err := p.GetAPIKey(false)
+	require.NoError(t, err)
+	require.Equal(t, "rk_live_flag1234567890", key)
+}
+
+func TestGetAPIKeyFallsBackToEnvVar(t *testing.T) {
+	t.Setenv("STRIPE_API_KEY", "sk_test_envvar1234567890")
+
+	p := Profile{}
+
+	key, err := p.GetAPIKey(false)
+	require.NoError(t, err)
+	require.Equal(t, "sk_test_envvar1234567890", key)
+}
+
 func helperLoadBytes(t *testing.T, name string) []byte {
 	bytes, err := os.ReadFile(name)
 	if err != nil {