mySecret is initialized only when the app is started, so it will only ever be what you have specified it to be in the environment variable once the app is started. Behind the scenes, the test changes the value of the environment variable without restarting your app while making calls to the /json endpoint. Move the mySecret initialization to be inside the handler, so it gets set each time the environment variable gets changed behind the scenes.