Environment Variables: The Right Way to Store Secrets

Hardcoding an API key directly into your source file works — right up until that file gets pushed to a public repository, or shared with someone who shouldn't have production access. Environment variables exist to keep secrets separate from code.

What an environment variable actually is

It's a key-value pair that lives in the operating system's process environment, not in any file your code reads directly. Your code asks for it by name at runtime — process.env.API_KEY in Node, os.environ["API_KEY"] in Python — and gets whatever value was set outside the code itself.

The .env file pattern

In local development, a .env file holds these values in one place:

# .env
API_KEY=sk_live_abc123
DATABASE_URL=postgres://localhost/myapp

A library like dotenv loads this file into the environment when your app starts. The critical step: .env must be listed in .gitignore before it's ever committed — once a secret hits git history, rotating the key is the only real fix, since removing it from a later commit doesn't erase it from history.

In production, no file at all

Most hosting platforms — Vercel, Heroku, AWS, and the rest — let you set environment variables through their dashboard or CLI instead of a file. The app code doesn't change between environments; only where the variables come from does.