@@ -98,6 +98,10 @@
 # =====================================================================
 app = Flask(__name__, static_folder='.', static_url_path='')
 
+# Validate required environment variables at startup
+# This will raise ValueError if any required variables are missing
+validate_required_env_vars()
+
 # Apply configuration to Flask app
 app.config.update(app_config.flask_config)
 
 
@@ -159,6 +159,21 @@ def validate(self) -> tuple[bool, list[str]]:
         """
         errors = []
 
+        # Check for required environment variables
+        required_vars = {
+            'JWT_SECRET_KEY': 'JWT authentication secret key',
+            'GOOGLE_BOOKS_API_KEY': 'Google Books API key for book discovery',
+            'DATABASE_URL': 'Database connection URL'
+        }
+        
+        for var_name, description in required_vars.items():
+            value = os.getenv(var_name, '').strip()
+            if not value or value.startswith('your-') or value.startswith('your_'):
+                errors.append(
+                    f"Missing or invalid {var_name}: {description}. "
+                    f"Please set {var_name} in your .env file."
+                )
+        
         # Validate JWT secret key
         if self.jwt.secret_key == 'default-dev-secret-key':
             if self.is_production():
@@ -296,4 +311,31 @@ def setup_logging(config: Config) -> logging.Logger:
 
 
 # Global configuration instance
-app_config = get_config()
+app_config = get_config()
+
+
+def validate_required_env_vars() -> None:
+    """
+    Validate that all required environment variables are set at startup.
+    
+    This function checks for critical configuration values that are needed
+    for the application to function properly. It's called before the Flask
+    app starts accepting requests.
+    
+    Raises:
+        ValueError: If any required environment variables are missing or invalid.
+    """
+    is_valid, errors = app_config.validate()
+    
+    if not is_valid:
+        error_message = (
+            "\n" + "="*70 + "\n"
+            "STARTUP ERROR: Missing or Invalid Environment Variables\n"
+            "="*70 + "\n" +
+            "\n".join(errors) +
+            "\n\n" +
+            "Please check your .env file and ensure all required variables are set.\n"
+            "See config/.env.example for reference.\n" +
+            "="*70 + "\n"
+        )
+        raise ValueError(error_message)
@@ -1,101 +1,59 @@
-# BiblioDrift Environment Configuration
-
-# JWT Configuration
-JWT_SECRET_KEY=your-super-secret-jwt-key-here
-
-# Database Configuration
-DATABASE_URL=sqlite:///biblio.db
-
 # BiblioDrift Environment Configuration Example
 # Copy this file to .env and customize for your environment
 
-# Application Environment (development, production, testing)
-APP_ENV=development
 # =============================================================================
-# SECURITY: Credential Encryption (Recommended for Production)
+# APPLICATION ENVIRONMENT
 # =============================================================================
-# To encrypt sensitive API keys, use the security_utils module:
-#   from security_utils import encrypt_credential
-#   encrypted_key = encrypt_credential("your-actual-api-key")
-#
-# Then set CREDENTIAL_MASTER_PASSWORD to enable decryption at runtime.
-# This prevents storing plain-text credentials in .env files.
-# =============================================================================
-
-# Master password for encrypting/decrypting credentials (OPTIONAL but RECOMMENDED)
-# Generate a secure password using: python -c "from security_utils import CredentialEncryption; print(CredentialEncryption.generate_master_password())"
-CREDENTIAL_MASTER_PASSWORD=your_secure_master_password_here
+APP_ENV=development
 
 # =============================================================================
-# SECURITY: Credential Encryption (Recommended for Production)
-# =============================================================================
-# To encrypt sensitive API keys, use the security_utils module:
-#   from security_utils import encrypt_credential
-#   encrypted_key = encrypt_credential("your-actual-api-key")
-#
-# Then set CREDENTIAL_MASTER_PASSWORD to enable decryption at runtime.
-# This prevents storing plain-text credentials in .env files.
+# REQUIRED: JWT & SECURITY CONFIGURATION
 # =============================================================================
-
-# Master password for encrypting/decrypting credentials (OPTIONAL but RECOMMENDED)
-# Generate a secure password using: python -c "from security_utils import CredentialEncryption; print(CredentialEncryption.generate_master_password())"
-CREDENTIAL_MASTER_PASSWORD=your_secure_master_password_here
-
-# Google Books API Key
-GOOGLE_BOOKS_API_KEY=your_google_id_here
-
-# JWT Configuration
-JWT_SECRET_KEY=your-super-secret-jwt-key-here
+# CRITICAL: Must be set before app startup. Generate a secure key in production.
+JWT_SECRET_KEY=your-super-secret-jwt-key-here-min-32-chars
 JWT_ACCESS_TOKEN_EXPIRES_DAYS=7
 JWT_ALGORITHM=HS256
 
-# Database Configuration
+# =============================================================================
+# REQUIRED: DATABASE CONFIGURATION
+# =============================================================================
+# CRITICAL: Must be set before app startup.
 DATABASE_URL=sqlite:///instance/biblio.db
 SQLALCHEMY_TRACK_MODIFICATIONS=False
 
-# Server Configuration
+
+# =============================================================================
+# SERVER CONFIGURATION
+# =============================================================================
 FLASK_HOST=127.0.0.1
 PORT=5000
-FLASK_DEBUG=True
-
-# Rate Limiting Configuration
-RATE_LIMIT_ENABLED=True
-RATE_LIMIT_WINDOW=60
-RATE_LIMIT_MAX_REQUESTS=30
+FLASK_DEBUG=False
 
-# Logging Configuration
-LOG_LEVEL=INFO
-LOG_FORMAT=%(asctime)s - %(name)s - %(levelname)s - %(message)s
-# LOG_FILE=logs/bibliodrift.log
+# =============================================================================
+# REQUIRED: API KEYS & EXTERNAL SERVICES
+# =============================================================================
+# CRITICAL: GOOGLE_BOOKS_API_KEY must be set before app startup.
+GOOGLE_BOOKS_API_KEY=your-google-books-api-key
 
-# AI Service Configuration
+# Optional AI Service Keys
 OPENAI_API_KEY=your-openai-api-key
 GROQ_API_KEY=your-groq-api-key
 GEMINI_API_KEY=your-gemini-api-key
 
-# Google Books API
-GOOGLE_BOOKS_API_KEY=your-google-books-api-key
 
-# Caching Configuration
-CACHE_TYPE=simple  # Options: simple, redis, null
+# =============================================================================
+# CACHING CONFIGURATION
+# =============================================================================
+CACHE_TYPE=simple
 REDIS_URL=redis://localhost:6379/0
 
 # Cache TTL Values (in seconds)
-CACHE_MOOD_ANALYSIS_TTL=86400     # 24 hours
-CACHE_RECOMMENDATIONS_TTL=3600    # 1 hour  
-CACHE_MOOD_TAGS_TTL=43200         # 12 hours
-CACHE_CHAT_RESPONSE_TTL=1800      # 30 minutes
-CACHE_GOODREADS_TTL=604800        # 7 days
-CACHE_DEFAULT_TIMEOUT=3600        # 1 hour
-
-# Flask Configuration
-FLASK_DEBUG=False
-FLASK_HOST=127.0.0.1
-PORT=5000
-
-# Logging
-LOG_LEVEL=INFO
-GOOGLE_BOOKS_API_KEY=your-google-books-api-key
+CACHE_MOOD_ANALYSIS_TTL=86400
+CACHE_RECOMMENDATIONS_TTL=3600
+CACHE_MOOD_TAGS_TTL=43200
+CACHE_CHAT_RESPONSE_TTL=1800
+CACHE_GOODREADS_TTL=604800
+CACHE_DEFAULT_TIMEOUT=3600
 
 # LLM Configuration
 PREFERRED_LLM=groq