Environment Variables

By the end of this lesson you will be able to:

1. Explain why a password or API key must never be typed into your source code.
2. Store settings in a .env file and load them with require('dotenv').config().
3. Read a value at runtime with process.env — for example, your server's port.
4. Add .env to .gitignore so your secrets never reach GitHub.

Last lesson you served JSON and static files. Today's server needs a database password and a payment key. Read this snippet, then spot what is dangerous:

const express = require('express')
const app = express()
const dbPassword = 'nasiLemak123'
const stripeKey = 'sk_live_8f3k9d2p7q'
app.listen(4000)

Predict together

• The code runs fine. So what is the problem?
• If Aisyah pushes this file to GitHub, who can now read that password and key?

Imagine your code is a wall everyone can read. You would never paint your house key onto the wall. Instead you keep it in a locked drawer. Your code walks to the drawer and asks for the key — but the key itself is never written on the wall.

That drawer is a .env file. An environment variable is a named setting kept outside your code. Node hands them to you through an object called process.env.

The syntax box

First, the drawer. A .env file is a plain list of NAME=value lines — one per line, no quotes needed:

PORT=4000
API_KEY=sk_live_9h2k4m7p1x

Next, your code asks the drawer for its values. One line at the very top loads the file; after that, every value is on process.env:

require('dotenv').config()

const port = process.env.PORT
console.log('Port is', port)

dotenv is a small package that reads the .env file and copies each line onto process.env. Call .config() before you read any value.

Why it matters

Two reasons. Security: keys stay off GitHub, so nobody can steal your database or spend your money. And flexibility: your laptop can use PORT=4000 while the live server uses a different port — same code, different drawer.

Wei Jie has an Express server with a hard-coded port. Follow along in your own project folder to move it into a .env file, the safe way.

Step 1 — Install dotenv

In the terminal, inside your project folder, run:

$ npm install dotenv

npm downloads the package and records it:

added 1 package in 1s

Step 2 — Create the .env file

Make a new file called .env (the name starts with a dot, and there is nothing before it). Put your settings inside:

PORT=4000
API_KEY=sk_live_9h2k4m7p1x

Step 3 — Read it in the server

Add require('dotenv').config() as the very first line, then use process.env.PORT:

require('dotenv').config()
const express = require('express')
const app = express()

const port = process.env.PORT || 3000

app.get('/', (req, res) => {
  res.send('Server is running.')
})

app.listen(port, () => {
  console.log('Listening on port ' + port)
})

The || 3000 is a fallback: if .env has no PORT, the server still starts on port 3000 instead of crashing.

Step 4 — Ignore .env in Git

Open (or make) a file called .gitignore and add one line so Git never tracks your secrets:

node_modules
.env

Step 5 — Run it

Start the server:

$ node server.js

Listening on port 4000

What changed? The port 4000 is no longer in your code — the server read it from the .env drawer. Change the file to PORT=5000, restart, and the server moves. Your secrets stay off GitHub, and your settings live in one tidy place.

Work in the same project. Restart the server after each change with node server.js to see it take effect.

1. Task 1 — Add a greeting

   Add a line GREETING=Selamat datang to your .env. In a route, read it with process.env.GREETING and send it back:

   app.get('/hi', (req, res) => {
     res.send(process.env.GREETING)
   })

   Visit /hi in your browser and check the greeting shows.

2. Task 2 — Move the port

   Change PORT in .env to a new number, for example PORT=5050. Restart the server. Confirm the terminal now prints Listening on port 5050, and visit the new address in your browser.

3. Task 3 — Prove it is ignored

   Make sure .env is listed in .gitignore. Then run git status in the terminal. Your .env file should not appear in the list of files to commit — Git is now ignoring it.

Build a route /welcome that returns a message using a SITE_NAME environment variable. It must combine today's concept with the routing you learned earlier in Section A.

It works if: with SITE_NAME=Advaslearning Hub in .env, visiting /welcome shows Welcome to Advaslearning Hub! — and if you delete that line, it still shows a sensible fallback instead of crashing.

require('dotenv').config()
const express = require('express')
const app = express()

// Fallback keeps the server working if the var is missing.
const siteName = process.env.SITE_NAME || 'our website'

app.get('/welcome', (req, res) => {
  res.send('Welcome to ' + siteName + '!')
})

app.listen(process.env.PORT || 3000)

Welcome to Advaslearning Hub!

• Never type passwords or API keys into your source code.
• Keep settings in a .env file — one NAME=value per line.
• dotenv loads that file: call require('dotenv').config() at the very top.
• Read any value at runtime with process.env.NAME, plus a || fallback.
• Add .env to .gitignore so secrets never reach GitHub.

New words

• Environment variable — a named setting kept outside your code.
• process.env — the object Node uses to hand you those settings.
• dotenv — a package that loads a .env file into process.env.
• .env — the file that holds your settings and secrets.
• .gitignore — a list of files Git must never track or upload.