# Diag: DD_API_KEY environment variable is not set
**Symptom (exact):** agent container log: `DD_API_KEY` not set / api key missing. Common right after a fresh Helm/docker deploy.
**Likely causes:** (a) secret not created, (b) secret name/key mismatch in the deployment, (c) var set in the wrong container (workload instead of agent).
**Confirm:**
1. Does the secret exist? `kubectl get secret [name]` in the agent namespace. Not found is (a).
2. Does the deployment reference it? Read the agent container env in the rendered manifest: `envFrom` / `valueFrom.secretKeyRef` names must match the secret and the key inside it exactly.
3. Exec into the agent container and echo the var length (not the value). Empty confirms it never arrived.
4. Helm chart path: is `apiKeyExistingSecret` (or the `apiKey` value) actually set in your values? An empty values file with the secret block commented out is the usual story.
**Fix:** create the secret with the org API key, fix the reference names, redeploy. Keep the key out of values files and out of chat; secret manager to orchestrator secret is the chain.
**Verify:** agent pod log shows a successful start and `agent status` in the pod shows the forwarder accepting payloads. Then confirm the host/node appears in Infrastructure.