What is a .env File
and How to Use It Safely

What is a .env file and how to use it safely is one of those fundamentals that every developer needs but few resources explain clearly. The short version: a .env file is where you store secrets — API keys, database passwords, tokens — so they live outside your code and never end up in Git. Here's the complete guide.

What is a .env File?

A .env file is a plain text file containing key-value pairs, one per line. Each line defines an environment variable that your application reads at runtime:

# .env — never commit this file
DATABASE_URL=postgresql://user:password@localhost:5432/myapp
STRIPE_SECRET_KEY=sk_live_abc123xyz
OPENAI_API_KEY=sk-proj-abc123
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
SENDGRID_API_KEY=SG.abc123
DEBUG=false
APP_ENV=production

Your application loads this file on startup and the values become available as environment variables — the same way variables set in your shell or on your hosting platform are available. The key insight is that secrets live in the file, not in your code.

The Problem It Solves

Without a .env file, developers often do this:

# Hardcoded in source — terrible
import openai
openai.api_key = "sk-proj-abc123"

# In a config file — also bad
config = {
  "db_password": "hunter2",
  "stripe_key": "sk_live_xyz"
}

# Read from environment
import os
import openai

openai.api_key = os.getenv("OPENAI_API_KEY")
db_url = os.getenv("DATABASE_URL")

Hardcoded secrets end up in Git. Once they're in Git history, they're there permanently — even if you delete the file later. And if your repo is public, bots will find the key within seconds of the push.

How to Use .env Files by Language/Framework

Python

pip install python-dotenv

from dotenv import load_dotenv
import os

load_dotenv()  # reads .env from current directory

api_key = os.getenv("OPENAI_API_KEY")
db_url  = os.getenv("DATABASE_URL")

Node.js

npm install dotenv

// At the very top of your entry file
require('dotenv').config();

const apiKey = process.env.STRIPE_SECRET_KEY;
const dbUrl  = process.env.DATABASE_URL;

Django

pip install django-environ

# settings.py
import environ
env = environ.Env()
environ.Env.read_env()  # reads .env

SECRET_KEY   = env('DJANGO_SECRET_KEY')
DATABASE_URL = env('DATABASE_URL')

PHP

composer require vlucas/phpdotenv

$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
$dotenv->load();

$dbPassword = $_ENV['DB_PASSWORD'];
$stripeKey  = $_ENV['STRIPE_SECRET_KEY'];

Ruby on Rails

Rails loads .env automatically in development via the dotenv-rails gem:

# Gemfile
gem 'dotenv-rails', groups: [:development, :test]

The .gitignore Rule — Non-Negotiable

Your .env file must be in .gitignore. Add this before your first commit:

# .gitignore
.env
.env.*
.env.local
.env.*.local
!.env.example

The ! before .env.example means "exclude from the exclusion" — it allows the example file to be committed while blocking all real .env files.

The .env.example Pattern

Always create a .env.example file alongside your .env. It shows other developers what variables are needed, without exposing real values:

# .env.example — safe to commit, no real secrets
DATABASE_URL=postgresql://user:password@localhost:5432/myapp_dev
STRIPE_SECRET_KEY=sk_live_your_key_here
OPENAI_API_KEY=sk-proj-your_key_here
AWS_ACCESS_KEY_ID=your_access_key_id
DEBUG=true
APP_ENV=development

When a new developer clones the repo they run cp .env.example .env and fill in their own values.

.env Best Practices

Production: Don't Use a .env File on the Server

A .env file is a development convenience. In production, use your platform's built-in environment variable management — it's more secure, auditable, and doesn't require deploying a secrets file:

If a Secret Ends Up in Your Logs

Environment variables can leak into application logs — database connection strings appear in ORM errors, API keys appear in failed request logs, and full .env contents can be printed by misconfigured debug modes. Before sharing any log with a colleague, StackOverflow or an AI assistant, run it through a sanitizer.

FAQ