     @key.tag
   end
 
-  defp get_key(tag) do
+  defp get_key_config(tag) do
     Enum.find(@keys, fn(key) -> key.tag == tag end)
   end
+
+  defp get_key_value(key_config) do
+    case key_config do
+      {:system, env_var} ->
+        System.get_env(env_var)
+      
+      _ ->
+        key_config.key
+    end
+  end
 end

      "Hello"
  """
  def decrypt(<<key_tag::binary-1, iv::binary-16, ciphertext::binary>> = _ciphertext) do
    key   = get_key(key_tag)
    state = :crypto.stream_init(:aes_ctr, key.key, iv)

    {_state, plaintext} = :crypto.stream_decrypt(state, ciphertext)
    plaintext

        keys: [
          %{tag: <<1>>, key: :base64.decode("..."), default: true},
          %{tag: <<2>>, key: :base64.decode("..."), default: false}
        ]

  If you want to store your key in the environment variable, you can use
  `{:system, "VAR"}` syntax:

      config :cloak, Cloak.AES.CTR,
        default: true,
        tag: "AES",
        keys: [
          %{tag: <<1>>, key: {:system, "CLOAK_KEY_PRIMARY"}, default: true},
          %{tag: <<2>>, key: {:system, "CLOAK_KEY_SECONDAY"}, default: false}
        ]

  ### Key Configuration Options
