From de5d80c2df0c063e966e318aa389aa321f3cbf6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <bjoern.fromme@ep-reisen.de>
Date: Thu, 8 Oct 2026 11:04:56 +0200
Subject: [PATCH] feat: replace hardcoded dummy api-key with env variable

---
 .env                           | 2 ++
 config/packages/framework.yaml | 1 +
 config/services.yaml           | 2 +-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.env b/.env
index 1c43487f..a9c336f0 100644
--- a/.env
+++ b/.env
@@ -82,6 +82,8 @@ APP_LEGAL_NOTICE_URL="https://www.ep-reisen.de/unternehmen/impressum-skireisever
 APP_TERMS_AND_CONDITIONS_URL="https://www.ep-reisen.de/skireisen/infos/allgemeine-infos/agb/"
 APP_PRIVACY_POLICY_URL="https://www.ep-reisen.de/unternehmen/impressum-skireiseveranstalter/datenschutz-winterreisen/"
 APP_CMS_API_BASE_URL="https://www.ep-reisen.de/"
+# TYPO3 API key (X-Api-Key), sent by the typo3.client scoped client; the real value per stage goes in .env.local
+APP_CMS_API_KEY=
 APP_WEBSITE_BASE_URL="https://www.ep-reisen.de/"
 APP_BASE_URL="https://my.ep-reisen.de"
 APP_CUSTOMER_SERVICE_EMAIL="kundenservice@ep-reisen.de"
diff --git a/config/packages/framework.yaml b/config/packages/framework.yaml
index 1d82f4a0..57f7db6f 100644
--- a/config/packages/framework.yaml
+++ b/config/packages/framework.yaml
@@ -22,6 +22,7 @@ framework:
           base_uri: '%env(resolve:APP_CMS_API_BASE_URL)%'
           headers:
             accept: 'text/json'
+            X-Api-Key: '%env(APP_CMS_API_KEY)%'
 
 when@test:
     framework:
diff --git a/config/services.yaml b/config/services.yaml
index 84b60f45..8d6c0982 100644
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -336,7 +336,7 @@ services:
     App\Service\CmsDataProvider:
       arguments:
         $httpClient: '@typo3.client'
-        $apiKey: 'AbcAbc123'# dummy key, not yet implemented
+        $apiKey: '%env(APP_CMS_API_KEY)%'
 
     App\Logger\RequestIdProcessor:
         tags: