SOFTWARE ENGINEERING

Home › Glossary › Software Engineering· 161 ·

Environment Variables

/en-vye-run-ment vair-ee-uh-buls/noun

Filed underSoftware EngineeringDevops

In brief · quick answer

Environment variables are key-value pairs stored outside your application code that configure behavior based on the environment: development, staging, or production. They keep secrets and settings out of your codebase.

§ 1 Definition

Environment variables are dynamic values that your application reads at runtime to determine its behavior. They are set outside the application code, typically in the operating system, container configuration, deployment platform settings, or a `.env` file kept out of version control. They are the standard way to manage configuration that differs between environments (development vs production) and to store sensitive information (API keys, database passwords, secret keys) that must never be committed to code repositories. The Twelve-Factor App methodology, which defines modern cloud application best practices, mandates that configuration be stored in environment variables.

§ 2 Why Environment Variables Matter

Hardcoding configuration in your source code creates security risks (secrets in Git history), environment-specific code branches (if (env === 'production') scattered everywhere), and deployment friction (code changes needed for different environments). Environment variables solve all three: secrets stay out of code, the same code runs everywhere, and each environment gets its own configuration. They are fundamental to modern CI/CD and Deployment Pipeline practices.

§ 3 Common Environment Variables

DATABASE_URL: connection string for the database. API_KEY and API_SECRET: credentials for third-party services. NODE_ENV or APP_ENV: current environment ('development', 'staging', 'production'). PORT: the port the web server should listen on. DEBUG: enable debug logging. S3_BUCKET: cloud storage bucket name. JWT_SECRET: token signing key. SMTP_HOST/MAIL_PASSWORD: email server credentials. Whatever your application needs to know but should not be hardcoded.

§ 4 Managing Environment Variables in Different Platforms

Local Development: `.env` file (add to .gitignore!). Vercel/Netlify: Dashboard settings, CLI, or project configuration. GitHub Actions: Repository secrets and environment-specific variables. Docker: `-e` flags, `env_file` in Docker Compose, or injected at container runtime. Kubernetes: ConfigMaps (non-sensitive) and Secrets (sensitive). AWS Lambda: Function configuration in the console or Infrastructure as Code.

§ 5 Note

Never commit .env files to Git. Add .env to your .gitignore immediately. For team projects, commit a .env.example file with placeholder values showing which variables are required.

§ 6 In code

```bash
# .env file (NEVER commit this!)
DATABASE_URL=postgresql://user:password@localhost:5432/mydb
API_KEY=sk_live_abc123
NODE_ENV=development
JWT_SECRET=your-secret-key
```

```javascript
// Node.js: reading environment variables
const db = require('knex')({
  client: 'pg',
  connection: process.env.DATABASE_URL
});

const port = process.env.PORT || 3000;
app.listen(port);
```

```python
# Python: reading environment variables
import os

database_url = os.environ.get('DATABASE_URL')
api_key = os.environ.get('API_KEY')
```

§ 7 Common questions

Q. What if I accidentally commit a .env file?: A. Immediately rotate any secrets that were exposed. Remove the file from Git history using git-filter-repo or BFG Repo Cleaner. Then add .env to .gitignore and push a force update.
Q. Are environment variables secure?: A. They are more secure than hardcoded secrets but not bulletproof. On compromised servers, attackers can read environment variables from process filesystems. Use vault solutions (HashiCorp Vault, AWS Secrets Manager) for high-security environments.

Key takeaways

Environment variables keep configuration and secrets out of your codebase.
The same code runs everywhere; environment variables customize it per environment.
Never commit .env files to Git. Use .env.example for documentation.
Rotate secrets immediately if they are accidentally exposed in source control.

How Atomic Glue helps

We configure environment variables securely across all environments for every project we build. Web Development services include proper secrets management from day one.

Get in touch

# Environment Variables

Category: Software Engineering (also: Devops)

Author: Atomic Glue Editorial Team

## Definition

## Why Environment Variables Matter

## Common Environment Variables

**DATABASE_URL**: connection string for the database. **API_KEY** and **API_SECRET**: credentials for third-party services. **NODE_ENV or APP_ENV**: current environment ('development', 'staging', 'production'). **PORT**: the port the web server should listen on. **DEBUG**: enable debug logging. **S3_BUCKET**: cloud storage bucket name. **JWT_SECRET**: token signing key. **SMTP_HOST/MAIL_PASSWORD**: email server credentials. Whatever your application needs to know but should not be hardcoded.

## Managing Environment Variables in Different Platforms

**Local Development**: `.env` file (add to .gitignore!). **Vercel/Netlify**: Dashboard settings, CLI, or project configuration. **GitHub Actions**: Repository secrets and environment-specific variables. **Docker**: `-e` flags, `env_file` in Docker Compose, or injected at container runtime. **Kubernetes**: ConfigMaps (non-sensitive) and Secrets (sensitive). **AWS Lambda**: Function configuration in the console or Infrastructure as Code.

## Note

Never commit .env files to Git. Add .env to your .gitignore immediately. For team projects, commit a .env.example file with placeholder values showing which variables are required.

## In code

## Common questions
Q: What if I accidentally commit a .env file?
A: Immediately rotate any secrets that were exposed. Remove the file from Git history using git-filter-repo or BFG Repo Cleaner. Then add .env to .gitignore and push a force update.
Q: Are environment variables secure?
A: They are more secure than hardcoded secrets but not bulletproof. On compromised servers, attackers can read environment variables from process filesystems. Use vault solutions (HashiCorp Vault, AWS Secrets Manager) for high-security environments.

## Key takeaways

Environment variables keep configuration and secrets out of your codebase.
The same code runs everywhere; environment variables customize it per environment.
Never commit .env files to Git. Use .env.example for documentation.
Rotate secrets immediately if they are accidentally exposed in source control.

## Related entries

Last updated July 2026. Permalink: atomicglue.co/glossary/environment-variables