Environment Variable Substitution vs Mock Service Stubs for Credential‑Free Integration Testing

Goal

Validate an API integration that consumes JSON configuration files without exposing production credentials.

Constraint

The test environment must keep the original JSON schema intact while ensuring that any secret tokens or connection strings are never sent to a live service. Two documented mechanisms exist:

• Injecting placeholder values via environment variables that replace real credentials during parsing.
• Using mock service stubs (e.g., WireMock, MockServer) to intercept HTTP calls and return predefined JSON responses.

Uncertainty

Both approaches preserve JSON structure, but they differ in how they interact with the JSON parser. Environment substitution depends on correct placeholder syntax and can be affected by duplicate key handling—some libraries keep the first value, others the last. Mock stubs require accurate request matching and can drift if the API contract changes.

Questions

1. Which method provides stronger isolation against accidental leakage of real credentials while maintaining schema validity?
2. How does duplicate‑key handling in common JSON parsers influence the reliability of environment‑variable substitution in tests?
3. What best practices exist for keeping mock stubs synchronized with evolving API contracts to avoid false positives?