What Are Environment Variables? Why You Can't Put API Keys in Code

English · 繁中 · Español · 日本語 · Português (BR)

Author: Danko Peng (@dankopeng)
Updated: March 2026
Reading time: ~6 minutes

---

Start with a Real Disaster

In 2022, a developer pushed code containing an AWS API key to GitHub.

Within four minutes, automated programs scanned and found the key.

Eight hours later, he received a $50,000 AWS bill.

This isn't an isolated case. Thousands of API keys are accidentally exposed on GitHub daily, scanned and abused by automated tools.

---

What Are Environment Variables?

Your app needs some "secret information" to function:

• Stripe API key (for payments)
• Resend API key (for sending emails)
• JWT secret (for signing login tokens)
• Database connection strings

These can't be written in code, because code gets pushed to GitHub.

Environment variables store this secret information outside of code—in the operating system or deployment platform's "environment." Your code reads these values at runtime, but the values themselves don't exist in code.

---

Local Development: .env Files

During local development, you typically create a .env file:

STRIPE_SECRET_KEY=sk_live_xxxxx
RESEND_API_KEY=re_xxxxx
JWT_SECRET=my-super-secret-key

Then read in code like this:

// Node.js / Remix
const stripeKey = process.env.STRIPE_SECRET_KEY

// Cloudflare Workers
const stripeKey = env.STRIPE_SECRET_KEY

Critical: .env files must NEVER be pushed to GitHub.

Confirm your .gitignore includes this line:

.env
.env.local
.env.production

---

Production Environment: Platform Secrets Management

Local .env only works on your own computer. When deploying to production, you need to set environment variables on the platform.

Cloudflare Workers approach:

# Set secret with Wrangler CLI
npx wrangler secret put JWT_SECRET
# After entering the value, Cloudflare encrypts and stores it, won't appear in any logs

Or manually set in Cloudflare Dashboard under Workers → Settings → Variables.

---

Common Mistakes

Mistake 1: Pushed .env to GitHub

# Remedy: remove from git history
git rm --cached .env
git commit -m "remove .env from tracking"

But if already pushed, assume the key is leaked, immediately go to the corresponding platform to revoke and regenerate a new key.

Mistake 2: Hardcoded key in code

// ❌ This exposes your key
const stripe = new Stripe("sk_live_xxxxx")

// ✅ Correct approach
const stripe = new Stripe(env.STRIPE_SECRET_KEY)

Mistake 3: console.log .env values

// ❌ Logs might be recorded
console.log("Stripe key:", env.STRIPE_SECRET_KEY)

// ✅ Only confirm existence, don't print value
console.log("Stripe key exists:", !!env.STRIPE_SECRET_KEY)

---

Danko Peng
X · YouTube · Threads

---

👉 Back to course index

Ready to skip the setup and start building?
👉 vibefast.app — Early bird $99, price increases to $199 on August 1, 2026.