diff --git a/src/keySources/env.js b/src/keySources/env.js
new file mode 100644
index 0000000..7f9185e
--- /dev/null
+++ b/src/keySources/env.js
@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2017 Tom Shawver
+ */
+
+'use strict'
+
+module.exports = () => {
+  return new Promise((resolve, reject) => {
+    if (process.env.CRYPTEX_ENV_KEY) {
+      resolve(process.env.CRYPTEX_ENV_KEY)
+    } else {
+      reject(new Error('CRYPTEX_ENV_KEY not assigned'))
+    }
+  })
+}
diff --git a/test/src/keySources/env.spec.js b/test/src/keySources/env.spec.js
new file mode 100644
index 0000000..ea9c00f
--- /dev/null
+++ b/test/src/keySources/env.spec.js
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2017 Tom Shawver
+ */
+
+'use strict'
+
+const getKey = require('src/keySources/env')
+
+describe('Environment Source', () => {
+  it('resolves with the provided key', () => {
+    process.env.CRYPTEX_ENV_KEY = 'bar'
+
+    return getKey().then((key) => {
+      should.exist(key)
+      key.should.equal('bar')
+    })
+  })
+  it('rejects when option "key" is missing', () => {
+    delete process.env.CRYPTEX_ENV_KEY
+    return getKey().should.be.rejected
+  })
+})