diff --git a/.github/workflows/environment-variable-names.yml b/.github/workflows/environment-variable-names.yml
new file mode 100644
index 000000000..f5b3abd55
--- /dev/null
+++ b/.github/workflows/environment-variable-names.yml
@@ -0,0 +1,30 @@
+name: Environment variable names
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - rc
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  environment-variable-names:
+    name: No tracked file names a variable starting with a digit or an old name
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Test the check
+        shell: pwsh
+        run: Invoke-Pester -Path ./ci/check-environment-variable-names.Tests.ps1 -CI
+
+      - name: Check the names
+        shell: pwsh
+        run: ./ci/check-environment-variable-names.ps1
diff --git a/AGENTS.md b/AGENTS.md
index 971eb5d05..7a0e7b924 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -125,7 +125,7 @@ java -cp examples/ip-intelligence/console/target/ip-intelligence-java-examples.c
 ```
 
 The example downloads the Lite file first when it is not there. In place of
-the argument, the `51DEGREES_IPI_PATH` environment variable or system property
+the argument, the `_51DEGREES_IPI_PATH` environment variable or system property
 can give the absolute path of a data file that is already there.
 
 On Java 24 or later, add `--enable-native-access=ALL-UNNAMED` before the class
@@ -183,7 +183,7 @@ java -cp examples/device-detection/console/target/device-detection-java-examples
 
 It prints the same `Input values:` and `Results:` blocks as the on-premise
 example. The IP Intelligence cloud examples read their key from
-`51DEGREES_RESOURCE_KEY` first and `TestResourceKey` second, and
+`_51DEGREES_RESOURCE_KEY` first and `TestResourceKey` second, and
 `examples/ip-intelligence/README.md` gives the keys to create for them.
 
 ### Pitfalls
diff --git a/ci/check-environment-variable-names.Tests.ps1 b/ci/check-environment-variable-names.Tests.ps1
new file mode 100644
index 000000000..7b9273d80
--- /dev/null
+++ b/ci/check-environment-variable-names.Tests.ps1
@@ -0,0 +1,92 @@
+# Tests for ci/check-environment-variable-names.ps1.
+#
+# Each case is one line of text and what the check must make of it. The
+# digit-initial name is matched in any case, because Windows reads an
+# environment variable name in any case, so a lower case old name is still
+# the old name there. The old names keep their case, for the reason the check
+# gives.
+
+BeforeAll {
+    $script:Check = Join-Path $PSScriptRoot 'check-environment-variable-names.ps1'
+    . $script:Check
+
+    function Get-Kind([string]$Line) {
+        @(Find-EnvironmentNameProblem $Line | ForEach-Object { $_.Kind })
+    }
+}
+
+Describe 'Find-EnvironmentNameProblem' {
+
+    It 'finds the digit-initial name <Line>' -ForEach @(
+        @{ Line = 'System.getenv("51DEGREES_IPI_PATH")' }
+        @{ Line = 'public static final String IPI = "51DEGREES_IPI_PATH";' }
+        @{ Line = '<DataFile>${51DEGREES_DD_PATH:-lite.hash}</DataFile>' }
+        @{ Line = "'51DEGREES_DD_PATH' = (Resolve-Path `$file).Path" }
+        @{ Line = 'System.getenv("51degrees_ipi_path")' }
+        @{ Line = '$env:51Degrees_Resource_Key = "key"' }
+    ) {
+        Get-Kind $Line | Should -Contain 'digit'
+    }
+
+    It 'finds the old name <Line>' -ForEach @(
+        @{ Line = 'System.getenv("RESOURCE_KEY")' }
+        @{ Line = 'env("_51DEGREES_RESOURCE_KEY", "RESOURCE_KEY");' }
+        @{ Line = 'env("_51DEGREES_LICENSE_KEY", "LICENSE_KEY");' }
+        @{ Line = 'public static final String FOD = "FOD_CLOUD_API_URL";' }
+        @{ Line = '$env:LICENSE_KEY = $Keys.TestResourceKey' }
+        @{ Line = '${env:LICENSE_KEY} = $Keys.TestResourceKey' }
+        @{ Line = '${Env:RESOURCE_KEY}' }
+        @{ Line = '$ENV:RESOURCE_KEY = "key"' }
+        @{ Line = 'Remove-Item Env:\LICENSE_KEY' }
+        @{ Line = '<Endpoint>${env:FOD_CLOUD_API_URL}</Endpoint>' }
+        @{ Line = '          url: ${{ env.FOD_CLOUD_API_URL }}' }
+        @{ Line = '${FOD_CLOUD_API_URL}' }
+        @{ Line = 'Constants.LEGACY_ENV_VARS' }
+        @{ Line = '          LICENSE_KEY: ${{ secrets.DEVICE_DETECTION_KEY }}' }
+        @{ Line = '- RESOURCE_KEY names the resource key' }
+        @{ Line = 'RESOURCE_KEY=my-key mvn test' }
+    ) {
+        Get-Kind $Line | Should -Contain 'fallback'
+    }
+
+    # The cloud request engine's tests name the query string parameter
+    # resource_key, which is on the wire and not in the environment, so the
+    # old names keep their case.
+    It 'leaves <Line> alone' -ForEach @(
+        @{ Line = 'assertEquals("resource_key=" + key, query);' }
+        @{ Line = '          DeviceDetection: ${{ secrets.DEVICE_DETECTION_KEY }}' }
+        @{ Line = '  PAID_RESOURCE_KEY: ${{ secrets.X }}' }
+        @{ Line = 'System.getenv("_51DEGREES_RESOURCE_KEY")' }
+        @{ Line = 'System.getenv("_51DEGREES_CLOUD_ENDPOINT")' }
+        @{ Line = '$env:_51DEGREES_DD_PATH = "file.hash"' }
+        @{ Line = '$env:_51degrees_dd_path = "file.hash"' }
+        @{ Line = '${env:_51DEGREES_LICENSE_KEY} = $Keys.TestResourceKey' }
+        @{ Line = 'assertEquals("${env:user.home}", substitutor.replace(line));' }
+        @{ Line = '  PAID_RESOURCE_KEY: ${{ env.PAID_RESOURCE_KEY }}' }
+        @{ Line = 'System.getenv("SUPER_RESOURCE_KEY")' }
+        @{ Line = 'Set the key with !!YOUR_RESOURCE_KEY!! in the readme.' }
+    ) {
+        Get-Kind $Line | Should -BeNullOrEmpty
+    }
+}
+
+Describe 'the check over a repository' {
+
+    # git quotes a path holding a non-ASCII character unless told not to,
+    # and a quoted path is not found on disk.
+    It 'reads a file whose name is not ASCII' {
+        $repo = Join-Path ([IO.Path]::GetTempPath()) ([Guid]::NewGuid())
+        New-Item -ItemType Directory $repo | Out-Null
+        try {
+            git -C $repo init -q
+            $name = 'Donn' + [char]0xE9 + 'es.java'
+            Set-Content -LiteralPath (Join-Path $repo $name) `
+                -Value 'System.getenv("51DEGREES_DD_PATH");'
+            git -C $repo add -A
+            { & $script:Check -RepoRoot $repo } |
+                Should -Throw '1 names start with a digit*'
+        } finally {
+            Remove-Item -Recurse -Force $repo
+        }
+    }
+}
diff --git a/ci/check-environment-variable-names.ps1 b/ci/check-environment-variable-names.ps1
new file mode 100644
index 000000000..6fa467c2d
--- /dev/null
+++ b/ci/check-environment-variable-names.ps1
@@ -0,0 +1,124 @@
+# Every 51Degrees environment variable name in this repository starts with an
+# underscore, because a POSIX shell cannot set a name that starts with a digit,
+# and each variable has one name with nothing read in its place. This reads
+# every file git tracks, which leaves out build output and the submodules, and
+# fails on any name that starts with the digit and on any old name that is
+# still read.
+#
+# Dot-sourcing the script defines Find-EnvironmentNameProblem without reading
+# the repository, which is how its tests use it.
+
+[CmdletBinding()]
+param(
+    # The root of the checkout to read. The default is the repository this
+    # script lives in.
+    [string]$RepoRoot = (Join-Path $PSScriptRoot '..')
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# The start of a name a shell cannot set, split so this file does not match
+# itself.
+$digitInitial = '5' + '1DEGREES_'
+
+# A name is not matched when a name character comes before it, so a name with
+# a leading underscore is left alone. It is matched in any case, because
+# Windows reads an environment variable name in any case, so a lower case
+# name that starts with the digit is still one a shell cannot set.
+$script:DigitInitialPattern = [regex]::new(
+    "(?<![A-Za-z0-9_])$digitInitial[A-Za-z0-9_]*",
+    [Text.RegularExpressions.RegexOptions]::IgnoreCase)
+
+# An old name read or set as an environment variable, or held in a constant to
+# fall back to. A Java read takes the name as a string, so a quoted bare name
+# is matched, along with the PowerShell and config forms the CI scripts and the
+# web example use, and a name at the start of a line past any spaces and a
+# list dash, which is how a workflow declares one as a key in an env: block
+# and how a readme lists one.
+#
+# The env token is matched on its own, in any case and with a following
+# backslash allowed, because PowerShell braces a name as well as prefixing
+# it, reads one through the Env: drive, and because the pipeline config
+# lookup and a workflow expression both brace one too. Wanting the dollar
+# and the token adjacent misses every braced form.
+#
+# These keep their case. The cloud request engine's tests name the query string
+# parameter resource_key, which differs from RESOURCE_KEY only by case, and a
+# query string parameter is on the wire rather than in the environment, so
+# matching in any case would fail on a name that is not an environment
+# variable at all.
+$script:FallbackPattern = [regex]::new(
+    '(?:["'']|(?i:env)[:.]\\?|\$\{|getenv\(\s*["'']|^[\t\- ]*)' +
+    '(?:RESOURCE_KEY|LICENSE_KEY|FOD_CLOUD_API_URL)(?![A-Za-z0-9_])|' +
+    '\bLEGACY_[A-Z_]*ENV_VARS?\b')
+
+# The problems on one line, each as its kind, 'digit' or 'fallback', and the
+# text matched.
+function Find-EnvironmentNameProblem([string]$Line) {
+    foreach ($match in $script:DigitInitialPattern.Matches($Line)) {
+        [pscustomobject]@{ Kind = 'digit'; Value = $match.Value }
+    }
+    foreach ($match in $script:FallbackPattern.Matches($Line)) {
+        [pscustomobject]@{ Kind = 'fallback'; Value = $match.Value }
+    }
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$root = (Resolve-Path $RepoRoot).Path
+# Paths are listed as they are, so a path holding a non-ASCII character is not
+# quoted and is still found.
+$tracked = & git -C $root -c core.quotePath=false ls-files
+if ($LASTEXITCODE -ne 0) {
+    throw "git ls-files failed in $root"
+}
+
+# The tests of this script name every form it fails on, on purpose.
+$ownTests = 'ci/check-environment-variable-names.Tests.ps1'
+
+$found = @()
+$fallbacks = @()
+$read = 0
+$skipped = @()
+foreach ($relative in $tracked) {
+    if ($relative -eq $ownTests) {
+        continue
+    }
+    $path = Join-Path $root $relative
+    # A submodule is tracked as a directory, and its files belong to another
+    # repository.
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
+        $skipped += $relative
+        continue
+    }
+    $read++
+    $lineNumber = 0
+    foreach ($line in [IO.File]::ReadLines($path)) {
+        $lineNumber++
+        foreach ($problem in Find-EnvironmentNameProblem $line) {
+            $text = "${relative}:${lineNumber}: $($problem.Value)"
+            if ($problem.Kind -eq 'digit') {
+                $found += $text
+            } else {
+                $fallbacks += $text
+            }
+        }
+    }
+}
+
+Write-Output ("$read paths read, $($skipped.Count) skipped as not files: " +
+    "$($skipped -join ', '), and $ownTests left out")
+
+if ($found.Count -gt 0 -or $fallbacks.Count -gt 0) {
+    Write-Output $found
+    Write-Output $fallbacks
+    throw ("$($found.Count) names start with a digit, which a POSIX shell " +
+        'cannot set, so each must start with an underscore, and ' +
+        "$($fallbacks.Count) old names are read, set or kept, where each " +
+        'variable has one name.')
+}
+
+Write-Output 'No tracked file names a variable starting with a digit or an old name.'
diff --git a/ci/run-integration-tests.ps1 b/ci/run-integration-tests.ps1
index 74b354718..ff9175676 100644
--- a/ci/run-integration-tests.ps1
+++ b/ci/run-integration-tests.ps1
@@ -165,7 +165,7 @@ if (-not $TestResourceKey) {
             Module = 'web/getting-started.onprem'
             Port = 8098
             ExampleEnv = @{
-                '51DEGREES_DD_PATH' = (Resolve-Path "$RepoName/cxx/data/device-detection/TAC-HashV41.hash").Path
+                '_51DEGREES_DD_PATH' = (Resolve-Path "$RepoName/cxx/data/device-detection/TAC-HashV41.hash").Path
             }
         }
     )
diff --git a/examples/device-detection/README.md b/examples/device-detection/README.md
index 4fa231de8..c83d69956 100644
--- a/examples/device-detection/README.md
+++ b/examples/device-detection/README.md
@@ -122,7 +122,7 @@ case the example runs until the process is stopped:
 PORT=8100 java -jar ./web/getting-started.onprem/target/device-detection-java-examples.web.getting-started.onprem-4.4.20-jar-with-dependencies.jar
 ```
 
-The on-premise web example takes its data file from the `51DEGREES_DD_PATH`
+The on-premise web example takes its data file from the `_51DEGREES_DD_PATH`
 environment variable, then from `TestDataFile`, and otherwise uses the free Lite file
 in `cxx/data/device-detection`, which it downloads before the server starts if it is
 missing.
diff --git a/examples/device-detection/web/getting-started.onprem/src/main/java/fiftyone/devicedetection/examples/web/GettingStartedWebOnPrem.java b/examples/device-detection/web/getting-started.onprem/src/main/java/fiftyone/devicedetection/examples/web/GettingStartedWebOnPrem.java
index 8387720c6..1ed151902 100644
--- a/examples/device-detection/web/getting-started.onprem/src/main/java/fiftyone/devicedetection/examples/web/GettingStartedWebOnPrem.java
+++ b/examples/device-detection/web/getting-started.onprem/src/main/java/fiftyone/devicedetection/examples/web/GettingStartedWebOnPrem.java
@@ -48,7 +48,7 @@
  * <p>
  * The configuration file for the pipeline is at src/main/webapp/WEB-INF/51Degrees-OnPrem.xml
  * <p>
- * The data file is taken from the 51DEGREES_DD_PATH environment variable, then
+ * The data file is taken from the _51DEGREES_DD_PATH environment variable, then
  * from TestDataFile (an environment variable or system property), and otherwise
  * the free Lite file in cxx/data/device-detection is used, which is downloaded
  * before the server starts if it is missing.
diff --git a/examples/device-detection/web/getting-started.onprem/src/main/webapp/WEB-INF/51Degrees-OnPrem.xml b/examples/device-detection/web/getting-started.onprem/src/main/webapp/WEB-INF/51Degrees-OnPrem.xml
index b74ec24f8..5ec7feb45 100644
--- a/examples/device-detection/web/getting-started.onprem/src/main/webapp/WEB-INF/51Degrees-OnPrem.xml
+++ b/examples/device-detection/web/getting-started.onprem/src/main/webapp/WEB-INF/51Degrees-OnPrem.xml
@@ -28,11 +28,11 @@
                 <AutoUpdate>false</AutoUpdate>
                 <CreateTempDataCopy>false</CreateTempDataCopy>
                 <!--
-                The data file is taken from the 51DEGREES_DD_PATH environment
+                The data file is taken from the _51DEGREES_DD_PATH environment
                 variable, then from TestDataFile (an environment variable or
                 system property), and otherwise the free Lite file is used.
                 -->
-                <DataFile>${51DEGREES_DD_PATH:-${TestDataFile:-cxx/data/device-detection/51Degrees-LiteV4.1.hash}}</DataFile>
+                <DataFile>${_51DEGREES_DD_PATH:-${TestDataFile:-cxx/data/device-detection/51Degrees-LiteV4.1.hash}}</DataFile>
                 <PerformanceProfile>LowMemory</PerformanceProfile>
             </BuildParameters>
             <BuilderName>DeviceDetectionHashEngine</BuilderName>
diff --git a/examples/device-detection/web/getting-started.onprem/src/test/java/fiftyone/devicedetection/examples/web/OnPremDataFileOptionTest.java b/examples/device-detection/web/getting-started.onprem/src/test/java/fiftyone/devicedetection/examples/web/OnPremDataFileOptionTest.java
index 108fbd615..c77110b95 100644
--- a/examples/device-detection/web/getting-started.onprem/src/test/java/fiftyone/devicedetection/examples/web/OnPremDataFileOptionTest.java
+++ b/examples/device-detection/web/getting-started.onprem/src/test/java/fiftyone/devicedetection/examples/web/OnPremDataFileOptionTest.java
@@ -35,12 +35,12 @@
 
 /**
  * Checks the order in which the on-premise web example picks its data file,
- * being 51DEGREES_DD_PATH first, then TestDataFile, then the Lite file.
+ * being _51DEGREES_DD_PATH first, then TestDataFile, then the Lite file.
  * System properties stand in for the environment variables, because the
  * lookup reads either and a test cannot set an environment variable.
  */
 public class OnPremDataFileOptionTest {
-    private static final String DD_PATH = "51DEGREES_DD_PATH";
+    private static final String DD_PATH = "_51DEGREES_DD_PATH";
     private static final String TEST_DATA_FILE = "TestDataFile";
     private static final String LITE =
             "cxx/data/device-detection/51Degrees-LiteV4.1.hash";
diff --git a/examples/ip-intelligence/README.md b/examples/ip-intelligence/README.md
index 0359dbaab..e3775778c 100644
--- a/examples/ip-intelligence/README.md
+++ b/examples/ip-intelligence/README.md
@@ -28,7 +28,7 @@ gives a link to ask for a copy. The Compare, Metrics and Suspicious examples nee
 properties, so with a free data file they say which they need and stop.
 [Contact us](https://51degrees.com/contact-us?utm_source=github&utm_medium=readme&utm_campaign=51degrees-java&utm_content=readme.md&utm_term=enterprise-data-file) for a copy of
 the Enterprise data file. To use it, place it in `cxx/data/ip-intelligence` and pass its path
-as the first argument, or set the `51DEGREES_IPI_PATH` environment variable or system
+as the first argument, or set the `_51DEGREES_IPI_PATH` environment variable or system
 property to its path.
 
 The Enterprise data file is over 6 GB, and the MaxPerformance profile loads all of it into
@@ -61,7 +61,7 @@ Compare and Suspicious examples with the Enterprise data file are skipped.
 
 The examples locate the data file in the following order:
 
-1. The `51DEGREES_IPI_PATH` environment variable or system property, which can
+1. The `_51DEGREES_IPI_PATH` environment variable or system property, which can
    be set to an explicit path to the data file. It is used in place of any
    file named without a full path.
 2. The path given as the first argument, or the free file the example uses
@@ -104,7 +104,7 @@ environment variable or system property.
 | MetadataCloud            | How to access the meta-data that relates to the properties available from the cloud IP intelligence service.                                 |
 
 Cloud examples need a resource key. The key is read from the
-`51DEGREES_RESOURCE_KEY` environment variable or system property first. The
+`_51DEGREES_RESOURCE_KEY` environment variable or system property first. The
 legacy `TestResourceKey` name is still supported and is checked second.
 
 The cloud property tiers changed in May 2026. The examples and this
diff --git a/examples/ip-intelligence/console/src/main/java/fiftyone/ipintelligence/examples/console/OfflineProcessing.java b/examples/ip-intelligence/console/src/main/java/fiftyone/ipintelligence/examples/console/OfflineProcessing.java
index c800a3d37..8bb5ea91b 100644
--- a/examples/ip-intelligence/console/src/main/java/fiftyone/ipintelligence/examples/console/OfflineProcessing.java
+++ b/examples/ip-intelligence/console/src/main/java/fiftyone/ipintelligence/examples/console/OfflineProcessing.java
@@ -184,7 +184,7 @@ public static void run(String dataFile, InputStream is, OutputStream os) throws
                 // We use the low memory profile, which reads the data file
                 // from disk as it is needed, because this example may be
                 // given the Enterprise data file, which is over 6 GB, through
-                // its first argument or 51DEGREES_IPI_PATH. MaxPerformance
+                // its first argument or _51DEGREES_IPI_PATH. MaxPerformance
                 // loads the whole data file into memory, which makes each
                 // lookup faster where there is memory to hold it.
                 .setPerformanceProfile(Constants.PerformanceProfiles.LowMemory)
diff --git a/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/DataFileHelper.java b/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/DataFileHelper.java
index 19c44616e..66e118cd2 100644
--- a/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/DataFileHelper.java
+++ b/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/DataFileHelper.java
@@ -133,7 +133,7 @@ public static String findAvailableDataFile(String... candidates) {
      * hold an explicit path to the IP Intelligence data file. This name is
      * checked first, before any search of the project space.
      */
-    public static final String IPI_PATH_ENV_VAR = "51DEGREES_IPI_PATH";
+    public static final String IPI_PATH_ENV_VAR = "_51DEGREES_IPI_PATH";
 
 public static class DatafileInfo {
         FiftyOneDataFile fileInfo;
diff --git a/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/KeyHelper.java b/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/KeyHelper.java
index 846c714f6..acb4fcf7c 100644
--- a/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/KeyHelper.java
+++ b/examples/ip-intelligence/shared/src/main/java/fiftyone/ipintelligence/examples/shared/KeyHelper.java
@@ -35,7 +35,7 @@ public class KeyHelper {
      * hold the resource key. This name is checked first, before the legacy
      * {@link #TEST_RESOURCE_KEY} name.
      */
-    public static final String RESOURCE_KEY_ENV_VAR = "51DEGREES_RESOURCE_KEY";
+    public static final String RESOURCE_KEY_ENV_VAR = "_51DEGREES_RESOURCE_KEY";
     public static final String TEST_RESOURCE_KEY = "TestResourceKey";
     static Logger logger = LoggerFactory.getLogger(KeyHelper.class);
 
diff --git a/examples/ip-intelligence/shared/src/test/java/fiftyone/ipintelligence/examples/shared/KeyHelperTest.java b/examples/ip-intelligence/shared/src/test/java/fiftyone/ipintelligence/examples/shared/KeyHelperTest.java
index 67b2660cb..809b7382f 100644
--- a/examples/ip-intelligence/shared/src/test/java/fiftyone/ipintelligence/examples/shared/KeyHelperTest.java
+++ b/examples/ip-intelligence/shared/src/test/java/fiftyone/ipintelligence/examples/shared/KeyHelperTest.java
@@ -88,7 +88,7 @@ public void requireResourceKey_NoKey_FailsNamingEveryName() {
         assertEquals("This test calls the live 51Degrees cloud service, so " +
                 "it needs a resource key and there is nothing to fall back " +
                 "on. None of _51DEGREES_RESOURCE_KEY, " +
-                "_51DEGREES_RESOURCE_KEY_BESPOKE, 51DEGREES_RESOURCE_KEY, " +
+                "_51DEGREES_RESOURCE_KEY_BESPOKE, _51DEGREES_RESOURCE_KEY, " +
                 "TestResourceKey is set, as an environment variable or as a " +
                 "system property, tried in that order. The key has to carry " +
                 "the ip and device products, because the test asks the " +
diff --git a/ip-intelligence/README.md b/ip-intelligence/README.md
index e653d488c..e5c19598b 100644
--- a/ip-intelligence/README.md
+++ b/ip-intelligence/README.md
@@ -35,7 +35,7 @@ data file.
 The free 'Lite' and Asn data files come from the [data](https://github.com/51Degrees/data) repository, which is the `cxx/data` folder of this repository. Run `cxx/data/get-data-files.sh ip-intelligence` from the root of this repository to download them, or `cxx\data\get-data-files.ps1 ip-intelligence` in PowerShell on Windows. Otherwise [contact us](https://51degrees.com/contact-us?utm_source=github&utm_medium=readme&utm_campaign=51degrees-java&utm_content=readme.md&utm_term=on-premise) to obtain an 'Enterprise' data file.
 
 For tests, the data file can be supplied explicitly by setting the
-`51DEGREES_IPI_PATH` environment variable or system property to the path of
+`_51DEGREES_IPI_PATH` environment variable or system property to the path of
 the .ipi file. When it is not set, the project space is searched for the
 expected file name, with the free 'Lite' file expected in
 `cxx/data/ip-intelligence`.
@@ -112,7 +112,7 @@ You will need [resource keys](https://51degrees.com/documentation/_services__clo
 
 The tests look for a resource key in the following order:
 
-1. The aligned `51DEGREES_RESOURCE_KEY` name, set as an environment variable
+1. The aligned `_51DEGREES_RESOURCE_KEY` name, set as an environment variable
    or as a system property.
 2. The legacy `TestResourceKey` name, which is still supported and is checked
    after the aligned name.
diff --git a/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/FileUtils.java b/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/FileUtils.java
index a39dd6b80..d3db631eb 100644
--- a/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/FileUtils.java
+++ b/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/FileUtils.java
@@ -43,7 +43,7 @@ public class FileUtils {
      * supply an explicit path to the IPI data file. When set and the file
      * exists it is used in preference to searching the project space.
      */
-    public static final String IPI_PATH_ENV_VAR = "51DEGREES_IPI_PATH";
+    public static final String IPI_PATH_ENV_VAR = "_51DEGREES_IPI_PATH";
 
     public static final String ENTERPRISE_IPI_DATA_FILE_NAME = "Enterprise-IpIntelligenceV41.ipi";
 
diff --git a/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/KeyUtils.java b/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/KeyUtils.java
index cabb6648c..8c6b1f225 100644
--- a/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/KeyUtils.java
+++ b/ip-intelligence/ip-intelligence.shared/src/main/java/fiftyone/ipintelligence/shared/testhelpers/KeyUtils.java
@@ -33,7 +33,7 @@ public class KeyUtils {
      * Name of the aligned environment variable or system property which
      * supplies the resource key. This name is checked before any legacy name.
      */
-    public static final String RESOURCE_KEY_ENV_VAR = "51DEGREES_RESOURCE_KEY";
+    public static final String RESOURCE_KEY_ENV_VAR = "_51DEGREES_RESOURCE_KEY";
 
     /**
      * Obtain a resource key from an environment variable or a system property.
diff --git a/ip-intelligence/ip-intelligence.translation/src/test/java/fiftyone/ipintelligence/translation/CountryTranslationIntegrationTest.java b/ip-intelligence/ip-intelligence.translation/src/test/java/fiftyone/ipintelligence/translation/CountryTranslationIntegrationTest.java
index a5eb58df6..028bec978 100644
--- a/ip-intelligence/ip-intelligence.translation/src/test/java/fiftyone/ipintelligence/translation/CountryTranslationIntegrationTest.java
+++ b/ip-intelligence/ip-intelligence.translation/src/test/java/fiftyone/ipintelligence/translation/CountryTranslationIntegrationTest.java
@@ -50,7 +50,7 @@
  * complete, localized, ordered country dropdown is produced.
  * <p>
  * The data file is resolved from the {@code TestDataFile} system property, the
- * {@code 51DEGREES_IPI_PATH} environment variable, or a few well known
+ * {@code _51DEGREES_IPI_PATH} environment variable, or a few well known
  * locations, and the test is skipped if none is found.
  * <p>
  * The IP Intelligence element data key has differed between engine versions
@@ -66,7 +66,7 @@ public class CountryTranslationIntegrationTest {
     private static String resolveDataFile() {
         String[] candidates = {
             System.getProperty("TestDataFile"),
-            System.getenv("51DEGREES_IPI_PATH"),
+            System.getenv("_51DEGREES_IPI_PATH"),
             "51Degrees-IPIV4EnterpriseIpiV41.ipi",
             "../51Degrees-IPIV4EnterpriseIpiV41.ipi",
             "../../51Degrees-IPIV4EnterpriseIpiV41.ipi",
diff --git a/pipeline/README.md b/pipeline/README.md
index d59dc839d..22e8e8118 100644
--- a/pipeline/README.md
+++ b/pipeline/README.md
@@ -131,13 +131,13 @@ and on our [website](https://51degrees.com/documentation/_device_detection__exam
 | pipeline.developer-examples.onpremise-engine       | Shows how to modify SimpleFlowElement to make use of the 'engine' functionality and use a custom data file to map dates to star signs rather than relying on hard coded data. |
 | pipeline.developer-examples.clientside-element     | Shows how to modify SimpleFlowElement to request the data of birth from the user using client-side JavaScript. |
 | pipeline.developer-examples.clientside-element-mvc | An example project showing how to use the code from SimpleClientSideElement in a Java web application using the Model-View-Controller Pattern. |
-| pipeline.developer-examples.cloud-engine           | Shows how to modify SimpleFlowElement to perform the star sign lookup via a cloud service rather than locally. The endpoint and resource key come from `FOD_CLOUD_API_URL` and `_51DEGREES_RESOURCE_KEY` when set, otherwise the star sign service the example was written for. |
+| pipeline.developer-examples.cloud-engine           | Shows how to modify SimpleFlowElement to perform the star sign lookup via a cloud service rather than locally. The endpoint and resource key come from `_51DEGREES_CLOUD_ENDPOINT` and `_51DEGREES_RESOURCE_KEY` when set, otherwise the star sign service the example was written for. |
 | pipeline.developer-examples.usage-sharing          | Shows how to share usage with 51Degrees. This helps us to keep our products up to date and accurate. |
 | pipeline.developer-examples.fodid                  | Shows how to read a 51Did, and, in a web demo, how a browser creates and verifies one against the 51Degrees cloud and the server redeems the encrypted result, so that the creator context proves the identifier is being presented by the browser it was created on. The module README describes the flow, the environment variables, what a run costs and the redeem call to copy into your own server. |
 
 ### Pointing the cloud examples at another host
 
-Every example that calls the 51Degrees cloud takes its endpoint from the `FOD_CLOUD_API_URL` environment variable, which is the cloud API base including the `/api/v4/` segment and defaults to `https://cloud.51degrees.com/api/v4/` (the cloud-engine example defaults to the star sign service it was written for, as its row above says). This is the same variable the cloud request engine in this repository honours, so setting it once points every example, and any pipeline built with the engine, at the same place. The resource key comes from `_51DEGREES_RESOURCE_KEY`, or the older `RESOURCE_KEY`.
+Every example that calls the 51Degrees cloud takes its endpoint from the `_51DEGREES_CLOUD_ENDPOINT` environment variable, which is the cloud API base including the `/api/v4/` segment and defaults to `https://cloud.51degrees.com/api/v4/` (the cloud-engine example defaults to the star sign service it was written for, as its row above says). This is the same variable the cloud request engine in this repository honours, so setting it once points every example, and any pipeline built with the engine, at the same place. The resource key comes from `_51DEGREES_RESOURCE_KEY`.
 
 A host other than cloud.51degrees.com would be used to (a) use an on premise web server, or (b) use a privately hosted version of the 51Degrees cloud for performance reasons. This is the private hosting option of the cloud service. Both run the same service, so the examples work unchanged.
 
diff --git a/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineBuilder.java b/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineBuilder.java
index b0d420a0b..29c27b960 100644
--- a/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineBuilder.java
+++ b/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineBuilder.java
@@ -87,12 +87,12 @@ protected CloudRequestEngine newEngine(List<String> properties) throws Exception
 
         /*
          *  Check if endPoint has been explicitly set via setEndpoint.
-         *  If not check for environment variable FOD_CLOUD_API_URL.
+         *  If not check for environment variable _51DEGREES_CLOUD_ENDPOINT.
          *  If nothing else is set, use default value.
          */
         if (endPoint == null || endPoint.isEmpty()) {
         	String envVarEndPoint = getEnvVar.apply(
-        		Constants.FOD_CLOUD_API_URL);
+        		Constants.CLOUD_ENDPOINT_VARIABLE);
         	if (envVarEndPoint == null || envVarEndPoint.isEmpty()) {
         		setEndpoint(Constants.END_POINT_DEFAULT);
         	}
diff --git a/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/Constants.java b/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/Constants.java
index b9b26c6ae..1a77c3537 100644
--- a/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/Constants.java
+++ b/pipeline/pipeline.cloudrequestengine/src/main/java/fiftyone/pipeline/cloudrequestengine/flowelements/Constants.java
@@ -27,7 +27,7 @@ public class Constants {
 	public static final String END_POINT_DEFAULT =
 		"https://cloud.51degrees.com/api/v4";
 	// Environment variable name to set end point
-	public static final String FOD_CLOUD_API_URL = "FOD_CLOUD_API_URL";
+	public static final String CLOUD_ENDPOINT_VARIABLE = "_51DEGREES_CLOUD_ENDPOINT";
 	// Default timeout for each request to the cloud service, as the
 	// specification's Configuration options table gives.
 	public static final int DEFAULT_TIMEOUT_MILLIS = 2000;
diff --git a/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineLiveTests.java b/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineLiveTests.java
index 1ef246c77..8f8487633 100644
--- a/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineLiveTests.java
+++ b/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/CloudRequestEngineLiveTests.java
@@ -52,8 +52,8 @@
  * is built, and the JSON request when it processes, so a change in the
  * service is seen here.
  * <p>
- * {@code FOD_CLOUD_API_URL} points the engine at another host, which the
- * builder reads for itself.
+ * {@code _51DEGREES_CLOUD_ENDPOINT} points the engine at another host,
+ * which the builder reads for itself.
  */
 public class CloudRequestEngineLiveTests {
 
diff --git a/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/LiveCloudKeys.java b/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/LiveCloudKeys.java
index 55be783d3..6bb87c5fe 100644
--- a/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/LiveCloudKeys.java
+++ b/pipeline/pipeline.cloudrequestengine/src/test/java/fiftyone/pipeline/cloudrequestengine/flowelements/LiveCloudKeys.java
@@ -40,7 +40,6 @@ final class LiveCloudKeys {
      */
     static final String[] RESOURCE_KEY_NAMES = {
         "_51DEGREES_RESOURCE_KEY",
-        "RESOURCE_KEY",
         "_51DEGREES_RESOURCE_KEY_BESPOKE",
         "TestResourceKey",
         "SUPER_RESOURCE_KEY",
@@ -53,7 +52,6 @@ final class LiveCloudKeys {
      */
     static final String[] LICENCE_KEY_NAMES = {
         "_51DEGREES_LICENSE_KEY",
-        "LICENSE_KEY",
         "_51DEGREES_LICENSE_KEY_BESPOKE",
         "_51DEGREES_LICENSE_KEY_CLOUDV5BESPOKE",
         "TestLicenseKey",
diff --git a/pipeline/pipeline.developer-examples/pipeline.developer-examples.cloud-engine/src/main/java/pipeline/developerexamples/cloudengine/Main.java b/pipeline/pipeline.developer-examples/pipeline.developer-examples.cloud-engine/src/main/java/pipeline/developerexamples/cloudengine/Main.java
index a1011c612..4b039d94c 100644
--- a/pipeline/pipeline.developer-examples/pipeline.developer-examples.cloud-engine/src/main/java/pipeline/developerexamples/cloudengine/Main.java
+++ b/pipeline/pipeline.developer-examples/pipeline.developer-examples.cloud-engine/src/main/java/pipeline/developerexamples/cloudengine/Main.java
@@ -54,9 +54,9 @@ public class Main {
         "https://cloud.51degrees.com/api/v4/";
 
     /**
-     * The cloud endpoint, taken from FOD_CLOUD_API_URL when that is set,
-     * which is the variable every 51Degrees cloud example honours and the
-     * one the cloud request engine builder reads by itself when no
+     * The cloud endpoint, taken from _51DEGREES_CLOUD_ENDPOINT when that is
+     * set, which is the variable every 51Degrees cloud example honours and
+     * the one the cloud request engine builder reads by itself when no
      * endpoint is given. A host other than cloud.51degrees.com would be
      * used to (a) use an on premise web server, or (b) use a privately
      * hosted version of the 51Degrees cloud for performance reasons,
@@ -66,7 +66,7 @@ public class Main {
      * directly.
      */
     static String endpoint() {
-        String value = env("FOD_CLOUD_API_URL");
+        String value = env("_51DEGREES_CLOUD_ENDPOINT");
         if (value == null) {
             // A resource key and an endpoint travel together, because a
             // key is only known to the service that issued it. So the
@@ -91,7 +91,6 @@ static String endpoint() {
      */
     static final String[] RESOURCE_KEY_NAMES = {
         "_51DEGREES_RESOURCE_KEY",
-        "RESOURCE_KEY",
         "_51DEGREES_RESOURCE_KEY_BESPOKE",
         "TestResourceKey",
         "SUPER_RESOURCE_KEY",
@@ -132,10 +131,10 @@ static String env(String name) {
     public static class Example {
         public void run() throws Exception {
 //! [usage]
-            // The endpoint comes from FOD_CLOUD_API_URL when it is set, so
-            // the example can be pointed at an on premise web server or a
-            // privately hosted version of the 51Degrees cloud, and
-            // otherwise at the star sign service it was written for.
+            // The endpoint comes from _51DEGREES_CLOUD_ENDPOINT when it is
+            // set, so the example can be pointed at an on premise web
+            // server or a privately hosted version of the 51Degrees cloud,
+            // and otherwise at the star sign service it was written for.
             CloudRequestEngine cloudRequestEngine =
                 new CloudRequestEngineBuilder(loggerFactory, httpClient)
                     .setEndpoint(endpoint())
diff --git a/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/README.md b/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/README.md
index 586556167..73ab80af9 100644
--- a/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/README.md
+++ b/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/README.md
@@ -51,7 +51,7 @@ The only server-side part of the flow is the redeem call, which adds
 the licence key the browser never sees. The `redeem` method in
 `CreatorContextDemoServer.java` is that call, and these are its
 essential lines. `DidClient` is built once at start-up from the
-resource key and the licence key (it reads `FOD_CLOUD_API_URL` itself
+resource key and the licence key (it reads `_51DEGREES_CLOUD_ENDPOINT` itself
 and falls back to the public cloud), and `did`, `result` and
 `challenge` are what the page passed on from `verify-full`:
 
@@ -90,9 +90,9 @@ scope.
 
 | Variable | Meaning |
 | --- | --- |
-| `_51DEGREES_RESOURCE_KEY` | Required. The resource key of the page, public by nature. The older name `RESOURCE_KEY` is read when this one is not set. |
-| `_51DEGREES_LICENSE_KEY` | Optional. A licence key of the same account, server side only. The older name `LICENSE_KEY` is read when this one is not set. Only an account that holds licence keys needs one to redeem, because the licence key is what keeps redemption to the acting party's own servers, so an account holding none redeems without one. |
-| `FOD_CLOUD_API_URL` | Optional. The cloud API base including the `/api/v4/` segment, defaulting to `https://cloud.51degrees.com/api/v4/`. This is the same variable the cloud request engine in this repository honours, so setting it once points every 51Degrees example at the same place. A trailing slash is added where missing. A host other than cloud.51degrees.com would be used to (a) use an on premise web server, or (b) use a privately hosted version of the 51Degrees cloud for performance reasons, which is the private hosting option of the cloud service. Both run the same service, so the examples work unchanged. |
+| `_51DEGREES_RESOURCE_KEY` | Required. The resource key of the page, public by nature. |
+| `_51DEGREES_LICENSE_KEY` | Optional. A licence key of the same account, server side only. Only an account that holds licence keys needs one to redeem, because the licence key is what keeps redemption to the acting party's own servers, so an account holding none redeems without one. |
+| `_51DEGREES_CLOUD_ENDPOINT` | Optional. The cloud API base including the `/api/v4/` segment, defaulting to `https://cloud.51degrees.com/api/v4/`. This is the same variable the cloud request engine in this repository honours, so setting it once points every 51Degrees example at the same place. A trailing slash is added where missing. A host other than cloud.51degrees.com would be used to (a) use an on premise web server, or (b) use a privately hosted version of the 51Degrees cloud for performance reasons, which is the private hosting option of the cloud service. Both run the same service, so the examples work unchanged. |
 | `PORT` | The port to listen on, defaulting to `5100`. |
 
 ### How to run
diff --git a/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/src/main/java/pipeline/developerexamples/fodid/CreatorContextDemoServer.java b/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/src/main/java/pipeline/developerexamples/fodid/CreatorContextDemoServer.java
index 02c7e8326..1057eb480 100644
--- a/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/src/main/java/pipeline/developerexamples/fodid/CreatorContextDemoServer.java
+++ b/pipeline/pipeline.developer-examples/pipeline.developer-examples.fodid/src/main/java/pipeline/developerexamples/fodid/CreatorContextDemoServer.java
@@ -101,11 +101,11 @@
  * {@code fodid/creator-context/} in this module's resources. Environment
  * variables:
  * <ul>
- * <li>{@code _51DEGREES_RESOURCE_KEY}, or the older {@code RESOURCE_KEY},
- * required. The resource key of the page, public by nature.</li>
- * <li>{@code _51DEGREES_LICENSE_KEY}, or the older {@code LICENSE_KEY},
- * optional. A licence key of the same account, server side only.</li>
- * <li>{@code FOD_CLOUD_API_URL}, optional. The cloud API base including
+ * <li>{@code _51DEGREES_RESOURCE_KEY}, required. The resource key of the
+ * page, public by nature.</li>
+ * <li>{@code _51DEGREES_LICENSE_KEY}, optional. A licence key of the same
+ * account, server side only.</li>
+ * <li>{@code _51DEGREES_CLOUD_ENDPOINT}, optional. The cloud API base including
  * the {@code /api/v4/} segment, defaulting to
  * {@code https://cloud.51degrees.com/api/v4/}. This is the same variable
  * the cloud request engine of this package honours.</li>
@@ -119,9 +119,9 @@ public class CreatorContextDemoServer {
     static final String RESOURCES = "/fodid/creator-context/";
 
     static final String RESOURCE =
-        env("_51DEGREES_RESOURCE_KEY", "RESOURCE_KEY");
+        env("_51DEGREES_RESOURCE_KEY");
     static final String LICENCE =
-        env("_51DEGREES_LICENSE_KEY", "LICENSE_KEY");
+        env("_51DEGREES_LICENSE_KEY");
 
     /**
      * The one client, built at start-up and shared by every request,
@@ -131,8 +131,8 @@ public class CreatorContextDemoServer {
 
     public static void main(String[] args) throws Exception {
         if (RESOURCE == null) {
-            System.err.println("Set _51DEGREES_RESOURCE_KEY (or the older "
-                + "RESOURCE_KEY) to the resource key of the page.");
+            System.err.println(
+                "Set _51DEGREES_RESOURCE_KEY to the resource key of the page.");
             System.exit(1);
         }
         if (LICENCE == null) {
@@ -149,7 +149,7 @@ public static void main(String[] args) throws Exception {
                 + "will report the context unreadable where it holds "
                 + "some.");
         }
-        // The client reads FOD_CLOUD_API_URL itself when no endpoint is
+        // The client reads _51DEGREES_CLOUD_ENDPOINT itself when no endpoint is
         // given, and falls back to the public cloud. A host other than
         // cloud.51degrees.com would be used to (a) use an on premise web
         // server, or (b) use a privately hosted version of the 51Degrees
diff --git a/pipeline/pipeline.did/README.md b/pipeline/pipeline.did/README.md
index 8784643ad..2b5fdea00 100644
--- a/pipeline/pipeline.did/README.md
+++ b/pipeline/pipeline.did/README.md
@@ -357,7 +357,7 @@ import fiftyone.pipeline.did.RedeemResult;
 // The resource key is the page's and public by nature. The licence key is
 // server side only and is needed to redeem where the account holds licence
 // keys. The endpoint defaults to https://cloud.51degrees.com/api/v4/, or
-// the FOD_CLOUD_API_URL environment variable where that is set.
+// the _51DEGREES_CLOUD_ENDPOINT environment variable where that is set.
 DidClient client = new DidClient(resourceKey, licenceKey);
 ```
 
diff --git a/pipeline/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java b/pipeline/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java
index 9afb29af1..cc4e28b92 100644
--- a/pipeline/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java
+++ b/pipeline/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java
@@ -114,7 +114,7 @@ public final class DidClient {
      * The environment variable read for the API base when the constructor
      * is given none, the same one the cloud request engine honours.
      */
-    public static final String ENDPOINT_VARIABLE = "FOD_CLOUD_API_URL";
+    public static final String ENDPOINT_VARIABLE = "_51DEGREES_CLOUD_ENDPOINT";
 
     /**
      * How old the whole held key list may be before a request for a key
diff --git a/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/DidClientLiveTests.java b/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/DidClientLiveTests.java
index a91f840a1..ea6055154 100644
--- a/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/DidClientLiveTests.java
+++ b/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/DidClientLiveTests.java
@@ -48,8 +48,8 @@
  * Tests against the live cloud service. They need a resource key, read
  * from the names {@link LiveCloudKeys} lists, and they fail rather than
  * skip when there is none, because a run that called nothing must not
- * report success. {@code FOD_CLOUD_API_URL} points them at another host,
- * and a licence key is taken from the names {@link LiveCloudKeys} lists
+ * report success. {@code _51DEGREES_CLOUD_ENDPOINT} points them at another
+ * host, and a licence key is taken from the names {@link LiveCloudKeys} lists
  * where the account holds one. Each test creates a 51Did through the
  * cloud {@code json} endpoint, which is one use against the resource key,
  * plus one for each cloud call it then makes.
@@ -103,9 +103,9 @@ public void redeem_GarbageResult_IsUnreadable() throws Exception {
                     "The cloud service at " + client.getEndpoint()
                     + " answered that it does not offer the creator "
                     + "context, so the redeem endpoint could not be "
-                    + "called. Point FOD_CLOUD_API_URL at a service that "
-                    + "offers it, or leave it unset for the 51Degrees "
-                    + "cloud.", reported.getCause());
+                    + "called. Point _51DEGREES_CLOUD_ENDPOINT at a "
+                    + "service that offers it, or leave it unset for the "
+                    + "51Degrees cloud.", reported.getCause());
             }
             throw reported;
         }
diff --git a/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/LiveCloudKeys.java b/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/LiveCloudKeys.java
index ba5efdc30..26061200e 100644
--- a/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/LiveCloudKeys.java
+++ b/pipeline/pipeline.did/src/test/java/fiftyone/pipeline/did/LiveCloudKeys.java
@@ -45,7 +45,6 @@ final class LiveCloudKeys {
      */
     static final String[] RESOURCE_KEY_NAMES = {
         "_51DEGREES_RESOURCE_KEY",
-        "RESOURCE_KEY",
         "_51DEGREES_RESOURCE_KEY_BESPOKE",
         "TestResourceKey",
         "SUPER_RESOURCE_KEY",
@@ -58,7 +57,6 @@ final class LiveCloudKeys {
      */
     static final String[] LICENCE_KEY_NAMES = {
         "_51DEGREES_LICENSE_KEY",
-        "LICENSE_KEY",
         "_51DEGREES_LICENSE_KEY_BESPOKE",
         "_51DEGREES_LICENSE_KEY_CLOUDV5BESPOKE",
         "TestLicenseKey",