Configuration in ASP.NET Core — appsettings, Environment Variables, Secrets

Introduction

ShopNest runs on your laptop, staging, and Azure production — each needs different connection strings and API keys. ASP.NET Core configuration merges JSON files, environment variables, and secrets with a clear priority order.

After this article you will

• Structure appsettings.json and environment-specific files
• Use IOptions, IOptionsSnapshot, IOptionsMonitor
• Store dev secrets in User Secrets — never in Git
• Bind complex configuration objects
• Introduce Azure Key Vault for production

Prerequisites

• Article 24 — Middleware
• ShopNest.Web with EF Core from Module 2

Concept deep-dive

Source priority (later wins)

1. appsettings.json
2. appsettings.{Environment}.json
3. User Secrets (Development only)
4. Environment variables
5. Command-line args
6. Azure Key Vault (if configured)

// appsettings.json
{
  "ShopNest": {
    "Payment": { "Provider": "Razorpay", "TimeoutSeconds": 30 },
    "FeatureFlags": { "NewCheckout": false }
  }
}

public class PaymentOptions
{
    public const string Section = "ShopNest:Payment";
    public string Provider { get; set; } = "";
    public int TimeoutSeconds { get; set; }
}

builder.Services.Configure<PaymentOptions>(
    builder.Configuration.GetSection(PaymentOptions.Section));

public class CheckoutController : Controller
{
    private readonly PaymentOptions _payment;
    public CheckoutController(IOptionsSnapshot<PaymentOptions> payment)
        => _payment = payment.Value;
}

User Secrets: dotnet user-secrets set "ShopNest:Payment:ApiKey" "rzp_test_xxx"

Hands-on — ShopNest Multi-Environment Deployment

1. Add appsettings.Staging.json with different DB connection.
2. Bind PaymentOptions and FeatureFlags classes.
3. Toggle NewCheckout flag in checkout view.
4. Document Key Vault setup for production (no keys in repo).

Common errors & best practices

• Committing appsettings.Production.json with secrets — use env vars / Key Vault.
• IOptions in Singleton expecting reload — use IOptionsMonitor.
• ASPNETCORE_ENVIRONMENT not set on server — wrong config file loaded.

Interview questions

Q: IOptions vs Snapshot vs Monitor?
A: Snapshot per request with reload; Monitor singleton with OnChange events.

Q: User Secrets purpose?
A: Local dev secrets outside project tree — never committed.

Q: Env var naming?
A: Double underscore for nesting: ShopNest__Payment__ApiKey.

Summary

• Configuration merges multiple sources with defined priority
• Options pattern gives typed, testable settings
• User Secrets + Key Vault keep payment keys out of Git
• Feature flags enable safe rollout per environment

Previous: Middleware
Next: Filters in ASP.NET Core

FAQ