backend/routes/config_routes.py

import os
from fastapi import APIRouter
router = APIRouter()

@router.get("/xr_key")
async def get_xr_key():
    # 8th Wall is self-hosted here (webar/external/xr/xr.js loaded via a static
    # <script>), so no runtime app key is required for the primary path. If an
    # EIGHTWALL_APP_KEY is ever configured (env or vault) for the hosted-CDN
    # variant, surface it; otherwise report self-hosted honestly rather than the
    # old literal "mock_key", which read like a broken/placeholder credential.
    key = os.environ.get("EIGHTWALL_APP_KEY", "").strip()
    if not key:
        try:
            from backend.services.usb_vault import get_secret
            key = (get_secret("EIGHTWALL_APP_KEY") or "").strip()
        except Exception:
            key = ""
    if key:
        return {"mode": "hosted", "key": key}
    return {"mode": "self_hosted", "key": None}

@router.get("/all")
async def get_all_config():
    return {}