os Module: Environment & Working Directory

By the end of this lesson you can:

• Read environment variables with os.getenv (with a safe default).
• Explain why secrets belong in the environment, never in source code.
• Load a .env file in development with python-dotenv.
• Find and change the working directory, and know when pathlib is the better choice.

Here's a mistake that has cost real people real money:

# DON'T DO THIS — ever
API_KEY = "sk-live-4f8a9b2c0d1e..."     # baked into the code
client = connect(API_KEY)

Commit that, push to GitHub, and bots scanning public repos will find and abuse the key within minutes. People have woken up to thousands of dollars in cloud charges this way.

What is an environment variable?

The operating system keeps a set of name=value pairs available to every program it launches — PATH, HOME, USERNAME, and any you add. They're perfect for configuration because they live outside your code and differ per machine.

Reading them safely

import os

# os.environ is a dict-like object of every variable
print(os.environ["PATH"])         # KeyError if missing — avoid for optional values

# os.getenv is the safe way: returns None (or a default) if missing
api_key = os.getenv("API_KEY")
debug   = os.getenv("DEBUG", "false")     # default if not set
print("debug mode:", debug)

Use os.getenv(name, default) for optional config so a missing variable doesn't crash your script. Reserve os.environ[name] for values that are genuinely required — then a clear KeyError tells you what's missing.

Setting them (for child processes)

os.environ["MY_FLAG"] = "1"     # visible to subprocesses you launch
# Note: this only affects THIS process and its children,
# not your real shell after the script ends.

The development pattern: a .env file

Typing export API_KEY=... before every run is tedious. In development, store config in a .env file and load it with the python-dotenv library (pip install python-dotenv):

# .env  (NEVER commit this — add it to .gitignore)
API_KEY=sk-live-abc123
DATABASE_URL=postgres://localhost/mydb
DEBUG=true

from dotenv import load_dotenv
import os

load_dotenv()                      # reads .env into the environment
api_key = os.getenv("API_KEY")     # now available like any env var

The working directory

import os

print(os.getcwd())             # current working directory (where you ran the script)
os.chdir("/some/folder")       # change it (rarely needed)

The "working directory" is where relative paths resolve. open("data.csv") looks in the working directory, which may not be where your script file lives. To reliably find files next to your script, anchor to the script's location:

from pathlib import Path

HERE = Path(__file__).resolve().parent     # folder containing THIS script
data = HERE / "data.csv"                    # always correct, wherever you run from

For path-building, prefer pathlib (Lesson 5); reach for os mainly for the environment and a few system bits.

Goal: a script whose behaviour is fully controlled by the environment — so the same code runs in dev and production without edits.

import os
from pathlib import Path
from dotenv import load_dotenv

load_dotenv()    # in dev, fills from .env; in prod, real env vars already exist

def get_config() -> dict:
    api_key = os.getenv("API_KEY")
    if not api_key:
        raise RuntimeError(
            "API_KEY is not set. Add it to .env (dev) or your "
            "platform's environment settings (production)."
        )
    return {
        "api_key": api_key,
        "output_dir": Path(os.getenv("OUTPUT_DIR", "output")),
        "debug": os.getenv("DEBUG", "false").lower() == "true",
        "max_retries": int(os.getenv("MAX_RETRIES", "3")),
    }

cfg = get_config()
cfg["output_dir"].mkdir(parents=True, exist_ok=True)

if cfg["debug"]:
    # never print the whole key — show it's loaded without leaking it
    print(f"API_KEY loaded (ends with …{cfg['api_key'][-4:]})")
print(f"Writing to {cfg['output_dir']}, up to {cfg['max_retries']} retries")

API_KEY loaded (ends with …c123)
Writing to output, up to 3 retries

Read the code

Every setting comes from the environment with a sensible default, the required API_KEY fails loudly with a helpful message if missing, and notice the debug print only shows the last four characters of the key — never the whole thing, never in logs. Strings from the environment are always text, so MAX_RETRIES is wrapped in int() and DEBUG is compared as a string. This single pattern lets identical code run safely everywhere.

Configuration — and above all secrets — belongs in the environment, never in source code. Read it with os.getenv(name, default) for optional values and os.environ[name] for required ones. In development, keep settings in a .env file loaded by python-dotenv, and always add .env to .gitignore; in production, set real environment variables. Remember everything from the environment is a string, so convert with int() and friends — and never print a full secret. For paths, anchor to Path(__file__).parent and prefer pathlib over the working directory.