---
id: w4/m2/t003
title: Env plumbing + update `docs/ADR006-bex-api.md` and `CLAUDE.md` env table
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m2/t001]
---

## Objective

Plumb the new configuration end to end — `BEX_AUTH_MODE`, `BEX_HYDRA_ADMIN_URL`, `BEX_KRATOS_URL` — from `operator/cmd/api/main.go` into the api package, into the bex-api deployment manifests, and into the docs.

## Context

- Existing env handling in `operator/cmd/api/main.go`; env tables live in root `CLAUDE.md` and `docs/ADR006-bex-api.md`.
- Deployment side: wherever bex-api's manifests set `BEX_API_TOKEN` today (GitOps `deploy/gitops/base/bex.yaml` values / kustomize config).

## Steps

1. Read + validate the three vars in `main.go` (fail fast if `ory` mode is set without URLs).
2. Add them to the bex-api deployment manifests, sourced from cluster-internal Service DNS.
3. Update the env table in root `CLAUDE.md` and the auth section of `docs/ADR006-bex-api.md`; run prettier.

## Files

- `operator/cmd/api/main.go`
- `deploy/gitops/base/bex.yaml` (or its values)
- `CLAUDE.md`, `docs/ADR006-bex-api.md`

## Acceptance criteria

- [ ] `ory` mode without `BEX_HYDRA_ADMIN_URL` exits with a clear error at startup.
- [ ] Docs env tables list all three vars; prettier passes.

## Out of scope

- Secret-managed values (URLs are not secrets); Helm-chart parametrization beyond what bex.yaml uses today.
