Environment variables
1. What environment variables are
Environment variables are key-value pairs stored by the operating system, available to any process you launch.
They exist so configuration doesn't live inside the code (especially sensitive data).
Example on Linux / macOS:
export NODE_ENV=production
export PORT=3000Example in Windows PowerShell:
$env:NODE_ENV="development"
$env:PORT="8080"After that, the variables are available to every process started from that session.
2. Reading environment variables in Node.js
Node.js exposes a global process.env object holding every environment variable:
console.log(process.env.NODE_ENV); // 'production'
console.log(process.env.PORT); // '3000'If a variable doesn't exist, it's undefined:
console.log(process.env.API_KEY); // undefined3. Setting variables at launch
You can set variables right in the run command.
Linux / macOS:
NODE_ENV=production PORT=8080 node app.jsWindows (cmd.exe):
set NODE_ENV=production && set PORT=8080 && node app.jsWindows (PowerShell):
$env:NODE_ENV="production"; $env:PORT="8080"; node app.js4. Using variables in code
They're usually used to configure the app:
const PORT = process.env.PORT || 3000;
const NODE_ENV = process.env.NODE_ENV || 'development';
app.listen(PORT, () => {
console.log(`Server running on port ${PORT} in ${NODE_ENV} mode`);
});If a variable isn't set, it's best to provide a fallback default.
5. Working with a .env file (dotenv)
Storing variables directly in the OS is inconvenient, especially during development.
So a .env file is usually created at the project root instead.
.env
NODE_ENV=development
PORT=4000
API_KEY=12345-ABCDE
DB_URL=postgres://user:pass@localhost/dbInstalling the package:
npm install dotenvLoading it in code:
import dotenv from 'dotenv';
dotenv.config();
console.log(process.env.DB_URL);After dotenv.config() runs, every variable from .env
is added to process.env.
6. Why environment variables matter
| Reason | Example |
|---|---|
| Separating environments | NODE_ENV=development / production |
| Security | API keys, passwords, tokens don't live in the code |
| Flexible configuration | Behavior can change without touching the source |
| Portability | The same code runs on different systems (dev/staging/prod) |
| CI/CD integration | Variables are passed through GitHub Actions, Docker, etc. |
7. A full example scenario
.env
NODE_ENV=production
PORT=8080
API_KEY=abc123app.js
import dotenv from 'dotenv';
dotenv.config();
console.log('ENV:', process.env.NODE_ENV);
console.log('API KEY:', process.env.API_KEY);
console.log('PORT:', process.env.PORT);
if (process.env.NODE_ENV === 'production') {
console.log('Running in production mode');
} else {
console.log('Running in development mode');
}Running it
node app.jsOutput:
ENV: production
API KEY: abc123
PORT: 8080
Running in production mode8. Where environment variables are used
| Area | Examples |
|---|---|
| Server settings | PORT, HOST, BASE_URL |
| Security | JWT_SECRET, API_KEY, DB_PASSWORD |
| Databases | DATABASE_URL, MONGO_URI, REDIS_HOST |
| Integrations | AWS_ACCESS_KEY, STRIPE_SECRET_KEY |
| Runtime mode | NODE_ENV=development / production |
9. Securing .env
-
Don't push
.envto GitHub, add it to.gitignoreinstead:javascript.env -
For deployment, store variables in the platform's environment settings (Heroku, Vercel, Docker, etc.)
-
Never log sensitive data (
process.env.PASSWORD).
10. Environment variables in Docker
In a Dockerfile:
ENV NODE_ENV=production
ENV PORT=8080or in docker-compose.yml:
environment:
- NODE_ENV=production
- PORT=8080Node.js inside the container still reads them through process.env.
11. Quick summary
| Point | Description |
|---|---|
| What it is | Keys and values defined in the process's environment |
| Access | process.env.VARIABLE |
| Setting them | Via export / set / .env |
| Library | dotenv for local files |
| Goal | Safe, flexible application configuration |
| Important | Never store .env in the repository |
In one sentence:
Environment variables are a way to pass external configuration into Node.js (mode, ports, keys, passwords, and so on) through
process.env, so the code stays generic, secure and independent of where it runs.
Short Answer
Interview readyA concise answer to help you respond confidently on this topic during an interview.