diff --git a/auth/jwt/main.go b/auth/jwt/main.go
index bccab6b..1680a88 100644
--- a/auth/jwt/main.go
+++ b/auth/jwt/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"log"
+	"os"
 
 	"github.com/go-kratos/examples/helloworld/helloworld"
 	"github.com/go-kratos/kratos/v2"
@@ -22,8 +23,15 @@ func (s *server) SayHello(ctx context.Context, in *helloworld.HelloRequest) (*he
 	return &helloworld.HelloReply{Message: "hello from service"}, nil
 }
 
+func getEnvOrDefault(key, defaultVal string) string {
+	if val := os.Getenv(key); val != "" {
+		return val
+	}
+	return defaultVal
+}
+
 func main() {
-	testKey := "testKey"
+	testKey := getEnvOrDefault("JWT_TEST_KEY", "change-me-in-production")
 	httpSrv := http.NewServer(
 		http.Address(":8000"),
 		http.Middleware(
@@ -40,7 +48,7 @@ func main() {
 			}),
 		),
 	)
-	serviceTestKey := "serviceTestKey"
+	serviceTestKey := getEnvOrDefault("JWT_SERVICE_TEST_KEY", "change-me-in-production")
 	con, _ := grpc.DialInsecure(
 		context.Background(),
 		grpc.WithEndpoint("dns:///127.0.0.1:9001"),
diff --git a/http/session/main.go b/http/session/main.go
index d94f1a4..118434b 100644
--- a/http/session/main.go
+++ b/http/session/main.go
@@ -61,7 +61,7 @@ func main() {
 	rdCmd := redis.NewClient(&redis.Options{
 		Addr: "127.0.0.1:6379",
 	})
-	store, err := sessions.NewRedisStore(rdCmd, []byte("secret"))
+	store, err := sessions.NewRedisStore(rdCmd, []byte(getEnvOrDefault("SESSION_SECRET_KEY", "change-me-in-production")))
 	store.SetMaxAge(10 * 24 * 3600)
 	if err != nil {
 		log.Fatal(err)