Env Var

You might say

I know a secret key shouldn't go in the code. Where should I put it?

Provide configuration outside the source codeEnvironment variables supply values such as API endpoints, feature settings, and secret keys when a program starts. Public browser variables are visible to visitors, even if their names come from an environment file. Keep real secrets on the server and document the required variable names with safe examples.

Know first

Terminal

.env · Local development configuration OPENAI_API_KEY=sk-proj-•••••• DATABASE_URL=postgres://••••

process.env.OPENAI_API_KEY 🛡 .gitignore rule has been matched; check git status before submitting

Quick checkChoose the best answer

A backend needs a third-party secret without committing it. Where should it live?

In a server-side deployment environment variable, with a real-value-free local exampleIn frontend configuration, hidden by not rendering itIn a code comment until just before release

You can say this to an AI Agent

Move this third-party secret from code into a server-side environment variable and add a real-value-free example variable name. Confirm neither git diff nor the client build contains the secret; after configuration, make one successful service call.

When to use it

Set different values for development and production
Provide server-side credentials
Configure an API endpoint
Turn deployment-specific features on or off

When NOT to use it

Commit a file containing real secrets
Put private keys in variables exposed to browser code
Assume changing a value updates a running process automatically
Leave required variables undocumented

Anatomy

OPENAI_API_KEY=sk-proj-•••••• # For local development, please do not submit

It is the convention to use all uppercase letters and underlines, so read this name in the code.

After the equal sign is the actual configuration value; when the key is included, it must be covered before taking the screenshot.

Notes starting with # will be ignored by the program.

Variants

.env

For local development use, should usually be excluded by .gitignore

Platform Env

Vercel → Settings → Env

Add another copy to the deployment platform settings page.

.env.example

Telling others what to wear is not true.

Typical use cases

Database connection

.env🔒 Do not submit

        # For local development

        OPENAI_API_KEY=sk-proj-8fk2••••••

        DATABASE_URL=postgres://localhost:5432

API credential

api.js

        const key = process.env.OPENAI_API_KEY;

        const res = await askAI(prompt, key);

The code reads the variable name; changing the configuration value locally usually does not require modifying the code

Site URL

.gitignore

        node_modules

        dist

        .env

🛡 Untracked files that match the rules will be skipped by git add; you still need to check git status before committing

Feature setting

Environment Variables

KEY

VALUE

Environment

OPENAI_API_KEY

••••••••

Production

DATABASE_URL

••••••••

Production