Configuration, Environment Variables & Dotenv

Managing 12-factor application secrets securely across development and production

« Middleware Architecture & Global Error Handling« Previous User Authentication with JWT & Bcrypt »Next »

Production applications must never hard-code API tokens, database connection strings, or private keys into source code. Storing config in the environment (process.env) is a foundational 12-Factor App principle.

Using process.env and .env Files

process.env: A global object injected by the Node.js runtime representing the host machine environment variables.

dotenv: A zero-dependency module that loads environment variables from a .env file into process.env.

Node 20+ feature: You can natively load env files without external packages using the --env-file=.env CLI flag.

Git security: Always append .env to .gitignore so secrets are never pushed to GitHub repositories.

Config Management with Validation

Try It Yourself »

// Run with: node --env-file=.env index.js
const config = {
  port: parseInt(process.env.PORT || '3000', 10),
  dbUrl: process.env.DATABASE_URL,
  jwtSecret: process.env.JWT_SECRET,
  isProduction: process.env.NODE_ENV === 'production',
};

// Strict startup assertion
function validateConfig(cfg) {
  const required = ['dbUrl', 'jwtSecret'];
  for (const key of required) {
    if (!cfg[key]) {
      throw new Error(`FATAL: Missing mandatory environment variable for ${key}`);
    }
  }
}

validateConfig(config);
console.log(`App booted in ${process.env.NODE_ENV || 'development'} mode on port ${config.port}`);

Validating environment configurations on startup prevents partial or degraded server runs.

Google AdSense Slot (inContentBanner)

Set your Publisher ID in src/config/ads.ts to display live ads.

Test Yourself With Exercise

+15 XP

Which file should ALWAYS be added to .gitignore to prevent leaking secret keys and database credentials?

« Previous: Middleware Architecture & Global Error Handling Next: User Authentication with JWT & Bcrypt »