How to Set and Use Environment Variables in Node.js: A Practical Guide

Hardcoding database credentials, API keys, and secrets into your source code is how breaches happen. Environment variables are how production applications safely manage sensitive data - let's do this right.

Why Environment Variables Matter

1. Hardcode everything - Database password in config.js, API key in a comment, secrets committed to git. This is how you get hacked. Don't do this.
2. Environment variables - Keep sensitive data separate from code. Different values for dev, staging, and production. Secure, scalable, and industry-standard.
3. Use a secrets manager - AWS Secrets Manager, HashiCorp Vault, etc. The enterprise approach for large systems.

What Environment Variables Actually Are

DB_PASSWORD=supersecret123
API_KEY=abc123xyz789
NODE_ENV=production

const password = process.env.DB_PASSWORD;  // "supersecret123"
const apiKey = process.env.API_KEY;        // "abc123xyz789"
const env = process.env.NODE_ENV;          // "production"

Why This Matters

The Problem: Manually Setting Variables Is Tedious

export DB_HOST=localhost
export DB_PASSWORD=mypassword
export API_KEY=key123

$env:DB_HOST="localhost"
$env:DB_PASSWORD="mypassword"
$env:API_KEY="key123"

Using Dotenv: The Easy Way

Step 1: Install Dotenv

npm install dotenv

yarn add dotenv

Step 2: Create a .env File

DB_HOST=localhost
DB_PORT=5432
DB_USER=admin
DB_PASSWORD=mysecurepassword
API_KEY=abc123xyz789
NODE_ENV=development
JWT_SECRET=your-jwt-secret-key
LOG_LEVEL=info

Step 3: Load Environment Variables in Your App

// app.js or server.js - FIRST LINE
require('dotenv').config();

// NOW you can use process.env
const express = require('express');
const app = express();

const dbHost = process.env.DB_HOST;
const dbPort = process.env.DB_PORT;
const apiKey = process.env.API_KEY;

console.log(`Connecting to database at ${dbHost}:${dbPort}`);
app.listen(3000);

Step 4: Add .env to .gitignore

# .gitignore
.env
.env.local
.env.*.local

Step 5: Share a Template (Without Secrets)

# .env.example - Commit this, not .env
DB_HOST=localhost
DB_PORT=5432
DB_USER=admin
DB_PASSWORD=change_me
API_KEY=change_me
NODE_ENV=development
JWT_SECRET=change_me
LOG_LEVEL=info

cp .env.example .env
# Then edit .env with real values

Practical Example: Express API with Environment Variables

// server.js
require('dotenv').config();

const express = require('express');
const postgres = require('pg');

const app = express();

// Read configuration from environment
const config = {
  db: {
    host: process.env.DB_HOST,
    port: process.env.DB_PORT,
    user: process.env.DB_USER,
    password: process.env.DB_PASSWORD,
    database: process.env.DB_NAME
  },
  api: {
    port: process.env.PORT || 3000,
    apiKey: process.env.API_KEY,
    jwtSecret: process.env.JWT_SECRET
  },
  env: process.env.NODE_ENV || 'development'
};

// Validate required variables
if (!config.api.apiKey) {
  throw new Error('API_KEY environment variable is required');
}

// Connect to database
const pool = new postgres.Pool(config.db);

// Routes
app.get('/api/users', (req, res) => {
  const authHeader = req.headers.authorization;
  const token = authHeader?.split(' ')[1];

  // Verify token using JWT_SECRET
  if (!token) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  // Query database using connection pool
  pool.query('SELECT * FROM users', (err, result) => {
    if (err) throw err;
    res.json(result.rows);
  });
});

// Start server
const port = config.api.port;
app.listen(port, () => {
  console.log(`Server running on port ${port} in ${config.env} mode`);
});

• Database credentials come from .env
• API keys and secrets are environment variables
• The same code runs in dev, staging, and production with different .env files
• Nothing sensitive is in your git repository

Best Practices for Environment Variables

1. Validate Required Variables at Startup

require('dotenv').config();

const required = ['DB_HOST', 'DB_USER', 'DB_PASSWORD', 'API_KEY'];
const missing = required.filter(key => !process.env[key]);

if (missing.length > 0) {
  throw new Error(`Missing required environment variables: ${missing.join(', ')}`);
}

2. Use a Config Object

// config.js
require('dotenv').config();

module.exports = {
  database: {
    host: process.env.DB_HOST,
    port: process.env.DB_PORT,
    user: process.env.DB_USER,
    password: process.env.DB_PASSWORD
  },
  api: {
    key: process.env.API_KEY,
    jwtSecret: process.env.JWT_SECRET
  },
  app: {
    port: process.env.PORT || 3000,
    environment: process.env.NODE_ENV || 'development'
  }
};

// Then use it
const config = require('./config');
console.log(config.database.host);

3. Use Different .env Files for Different Environments

.env                 # Default/development
.env.production      # Production-specific overrides
.env.test            # Test environment

const envFile = process.env.NODE_ENV === 'production' 
  ? '.env.production' 
  : '.env';
  
require('dotenv').config({ path: envFile });

4. Prefix Related Variables

# Database
DB_HOST=localhost
DB_PORT=5432
DB_USER=admin

# Redis
REDIS_HOST=localhost
REDIS_PORT=6379

# Third-party services
STRIPE_API_KEY=sk_...
SENDGRID_API_KEY=SG....

5. Document What Each Variable Does

# Database connection
DB_HOST=localhost         # PostgreSQL host
DB_PORT=5432             # PostgreSQL port
DB_USER=admin            # Database username
DB_PASSWORD=change_me    # Database password

# API Configuration
API_KEY=change_me        # Third-party API key
JWT_SECRET=change_me     # Secret for signing JWTs

# Application
PORT=3000                # Express server port
NODE_ENV=development     # Environment (development/staging/production)

Dotenv Alternatives for Production

AWS Secrets Manager

HashiCorp Vault

Environment Variables in CI/CD

Kubernetes Secrets

Learning Node.js Properly

The Bottom Line: Keep Secrets Secret