Module 4 · Ship it: deploy, monitor, hand over Lesson 10 of 15
Environment variables and secrets
Database passwords and API keys live in the environment, never in the repository. A leaked key is the most common self-taught project failure.
The concept
An environment variable is a value the app reads at run time instead of having it written into the code: the database password, the API key, the port. Your app asks the operating system for process.env.DATABASE_URL and gets a different answer on your laptop and on the server, with no code change.
Keep the names in a committed .env.example with placeholder values, and the real values in .env, which goes in .gitignore — before the first commit, not after. If a key ever reaches a public repository, treat it as leaked and rotate it; deleting the commit does not un-leak what has been cloned.
Common mistakes
The mistake is committing .env in the first five minutes because the build would not start otherwise. Spend that time on .gitignore instead. Environment variables are also why the same build works locally and in production, so this is setup that pays for itself all the way through.
Worked example
process.env.DATABASE_URL with a .env file locally and never committed — add .env to .gitignore before the first commit, not after.
Your practice task
Move every secret in your project into environment variables and confirm .env is ignored by git.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
An environment variable is a value the app reads at run time instead of having it written into the code: the database password, the API key, the port.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.