         keys: [
           %{tag: <<1>>, key: :base64.decode("..."), default: true},
           %{tag: <<2>>, key: :base64.decode("..."), default: false}
+        ]
+
+  If you want to store your key in the environment variable, you can use
+  `{:system, "VAR"}` syntax:
+
+      config :cloak, Cloak.AES.CTR,
+        default: true,
+        tag: "AES",
+        keys: [
+          %{tag: <<1>>, key: {:system, "CLOAK_KEY_PRIMARY"}, default: true},
+          %{tag: <<2>>, key: {:system, "CLOAK_KEY_SECONDAY"}, default: false}
         ]
 
   ### Key Configuration Options

      "Hello"
  """
  def decrypt(<<key_tag::binary-1, iv::binary-16, ciphertext::binary>> = _ciphertext) do
    key   = get_key(key_tag)
    state = :crypto.stream_init(:aes_ctr, key.key, iv)

    {_state, plaintext} = :crypto.stream_decrypt(state, ciphertext)
    plaintext

    @key.tag
  end

  defp get_key_config(tag) do
    Enum.find(@keys, fn(key) -> key.tag == tag end)
  end

  defp get_key_value(key_config) do
    case key_config do
      {:system, env_var} ->
        System.get_env(env_var)
      
      _ ->
        key_config.key
    end
  end
end
