Skip to content
BackendExpressJsNodeJs

8. Express.js में Environment Variables – .env File कैसे Use करें

April 24, 2026 19 min read
8. Express.js में Environment Variables – .env File कैसे Use करें

नमस्ते दोस्तों! 🙏
स्वागत है The Easy Master पर!

क्या तुमने कभी सोचा है – Database password, API keys, JWT secrets – ye sensitive data code mein hardcode karna safe kyun nahi hai?

Agar tum GitHub par code push karoge toh sabko dikh jayega! Hackers tumhare database ko access kar sakte hain. Environment variables is problem ka solution हैं।

Express.js environment variables Hindi में समझना बहुत जरूरी है क्योंकि:

  • Security – sensitive data code se bahar rakho
  • Different environments – development, staging, production ke alag config
  • No hardcoding – port, database URL, API keys
  • Industry standard – har company env variables use karti है
  • 12-factor app – best practice for modern apps

Aaj kya seekhoge?

TopicKya Seekhega?
Environment Variables Kya Hain?Concept aur importance
dotenv PackageInstallation aur setup
.env FileVariables store karna
Accessing Variablesprocess.env se read karna
Different Environmentsdevelopment, production, staging
ValidationRequired variables check karna
Best PracticesSecurity tips
Real ProjectComplete setup

Kya tumhe pata hai?
.env file ko never GitHub par push karna chahiye – हमेशा .gitignore में add करो!

तो चलिए शुरू करते हैं – Express.js environment variables Hindi सीखने का सफर! 🚀

Table of Contents

1. Environment Variables क्या Hain? – Introduction

Environment variables key-value pairs होते हैं जो application ke bahar store होते हैं।

Without Environment Variables (❌ Bad Practice):

Code
// ❌ NEVER DO THIS!
const app = require('express')();

// Hardcoded credentials – SECURITY RISK!
const DB_PASSWORD = 'mypassword123';
const JWT_SECRET = 'mysecretkey';
const API_KEY = 'abc123xyz';
const PORT = 3000;

// Database connection with hardcoded password
mongoose.connect(`mongodb://admin:mypassword123@localhost:27017/mydb`);

app.listen(PORT);

Problems:

  • 🔴 GitHub par push karoge toh sabko dikhega
  • 🔴 Hackers easily access kar sakte hain
  • 🔴 Different environments (dev/prod) ke liye alag values nahi daal sakte
  • 🔴 Code change karna padta hai environment change karne ke liye

With Environment Variables (Good Practice):

Code
// ✅ BEST PRACTICE!
require('dotenv').config();

const app = require('express')();

// Read from environment variables
const DB_PASSWORD = process.env.DB_PASSWORD;
const JWT_SECRET = process.env.JWT_SECRET;
const PORT = process.env.PORT || 3000;

// Database connection
mongoose.connect(`mongodb://admin:${DB_PASSWORD}@localhost:27017/mydb`);

app.listen(PORT);
Code
# .env file (never commit to GitHub!)
DB_PASSWORD=mypassword123
JWT_SECRET=mysecretkey
API_KEY=abc123xyz
PORT=3000

Benefits:

  • 🟢 Secrets code से बाहर
  • 🟢 GitHub safe
  • 🟢 Different environments ke liye alag .env files
  • 🟢 No code change for different configs

Express.js environment variables Hindi में हम professional setup सीखेंगे।

2. Why Environment Variables? – Benefits

Top 5 Benefits:

BenefitExplanation
SecuritySecrets code में नहीं होते, .gitignore में होते हैं
FlexibilityBina code change किए config change कर सकते हो
Multi-environmentDev, staging, production – अलग-अलग configs
Team collaborationहर developer के पास अपनी .env file हो सकती है
12-factor appIndustry standard best practice

Real-world Scenario:

Code
// Same code, different environments

// Development (.env.development)
DB_HOST=localhost
DB_NAME=dev_db
DEBUG=true

// Production (.env.production)
DB_HOST=cluster.mongodb.net
DB_NAME=prod_db
DEBUG=false

// Code remains the same!
const dbHost = process.env.DB_HOST;
const dbName = process.env.DB_NAME;
const debug = process.env.DEBUG === 'true';

What to Store in .env:

Code
# ✅ GOOD to store in .env
PORT=3000
NODE_ENV=development
DB_HOST=localhost
DB_USER=admin
DB_PASSWORD=secret123
JWT_SECRET=very_long_random_string
API_KEY=abc123xyz
EMAIL_HOST=smtp.gmail.com
EMAIL_USER=myapp@gmail.com
EMAIL_PASS=app_password
REDIS_URL=redis://localhost:6379
AWS_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# ❌ NOT to store in .env
# - Code logic
# - HTML templates
# - Routes
# - Business logic

3. dotenv Package – Installation

Step 1: Install dotenv

Code
npm install dotenv

Step 2: Create .env File

Code
# .env
PORT=3000
NODE_ENV=development
DB_HOST=localhost
DB_PORT=27017
DB_NAME=mydb
DB_USER=admin
DB_PASSWORD=secret123
JWT_SECRET=my_super_secret_key_2026
JWT_EXPIRES_IN=7d
BCRYPT_ROUNDS=10
API_KEY=abc123xyz
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USER=myapp@gmail.com
EMAIL_PASS=app_password_here

Step 3: Load dotenv in Express

Code
// server.js
// Method 1: Load at the very top (recommended)
require('dotenv').config();

const express = require('express');
const app = express();

console.log('PORT:', process.env.PORT);
console.log('NODE_ENV:', process.env.NODE_ENV);
console.log('DB_HOST:', process.env.DB_HOST);

app.listen(process.env.PORT || 3000);

Step 4: Add .env to .gitignore

Code
# .gitignore
node_modules/
.env
.env.*
!.env.example
.DS_Store
*.log

Step 5: Create .env.example (for team)

Code
# .env.example (commit to GitHub)
# Copy this file to .env and fill your values

PORT=3000
NODE_ENV=development
DB_HOST=localhost
DB_PORT=27017
DB_NAME=mydb
DB_USER=admin
DB_PASSWORD=your_password_here
JWT_SECRET=your_jwt_secret_here
JWT_EXPIRES_IN=7d
BCRYPT_ROUNDS=10
API_KEY=your_api_key_here
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USER=your_email@gmail.com
EMAIL_PASS=your_app_password

4. .env File – Variables Store Karna

.env File Syntax Rules:

Code
# .env file syntax

# 1. Basic key=value (no quotes needed)
PORT=3000
NODE_ENV=production

# 2. Strings with spaces (use quotes)
APP_NAME="My Express App"
WELCOME_MESSAGE='Hello World!'

# 3. Numbers (no quotes)
MAX_USERS=1000
TIMEOUT=5000

# 4. Booleans (as strings, parse manually)
DEBUG=true
ENABLE_LOGGING=false

# 5. Comments (start with #)
# This is a comment
DB_HOST=localhost # inline comment also works

# 6. Multi-line values (use quotes)
CERTIFICATE="-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKlKjH...
-----END CERTIFICATE-----"

# 7. Empty values
EMPTY_VAR=

# 8. Special characters (use quotes)
PASSWORD="p@ssw0rd#123!"
API_KEY="abc-123_xyz"

# 9. Expand variables (using ${})
DB_URL=mongodb://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}

# 10. Override defaults
# Values can be overridden by system environment variables

Multiple .env Files:

Code
# Different files for different environments
.env                # Default (loaded first)
.env.development    # Development overrides
.env.production     # Production overrides
.env.local          # Local overrides (gitignored)
.env.test           # Testing environment

Loading Specific .env File:

Code
// server.js
const dotenv = require('dotenv');
const path = require('path');

// Load based on NODE_ENV
const envFile = process.env.NODE_ENV === 'production' 
  ? '.env.production' 
  : '.env.development';

dotenv.config({ path: path.resolve(process.cwd(), envFile) });

// Or load multiple files (later ones override earlier)
dotenv.config(); // loads .env
dotenv.config({ path: '.env.local', override: true });

5. Accessing Variables – process.env

Basic Access:

Code
// server.js
require('dotenv').config();

// Access environment variables
const PORT = process.env.PORT || 3000;
const NODE_ENV = process.env.NODE_ENV || 'development';
const DB_HOST = process.env.DB_HOST;
const DB_PASSWORD = process.env.DB_PASSWORD;

console.log(`Server running on port ${PORT}`);
console.log(`Environment: ${NODE_ENV}`);

Complete Express Config with Env Variables:

Code
// config/index.js
require('dotenv').config();

module.exports = {
  // Server
  port: parseInt(process.env.PORT, 10) || 3000,
  nodeEnv: process.env.NODE_ENV || 'development',
  
  // Database
  db: {
    host: process.env.DB_HOST || 'localhost',
    port: parseInt(process.env.DB_PORT, 10) || 27017,
    name: process.env.DB_NAME || 'mydb',
    user: process.env.DB_USER,
    password: process.env.DB_PASSWORD,
    url: process.env.DB_URL || `mongodb://${process.env.DB_USER}:${process.env.DB_PASSWORD}@${process.env.DB_HOST}:${process.env.DB_PORT}/${process.env.DB_NAME}`
  },
  
  // JWT
  jwt: {
    secret: process.env.JWT_SECRET,
    expiresIn: process.env.JWT_EXPIRES_IN || '7d',
    refreshSecret: process.env.JWT_REFRESH_SECRET,
    refreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || '30d'
  },
  
  // Email
  email: {
    host: process.env.EMAIL_HOST,
    port: parseInt(process.env.EMAIL_PORT, 10) || 587,
    user: process.env.EMAIL_USER,
    pass: process.env.EMAIL_PASS,
    from: process.env.EMAIL_FROM || 'noreply@myapp.com'
  },
  
  // API Keys
  apiKeys: {
    google: process.env.GOOGLE_API_KEY,
    stripe: process.env.STRIPE_SECRET_KEY,
    sendgrid: process.env.SENDGRID_API_KEY
  },
  
  // Features
  features: {
    enableLogging: process.env.ENABLE_LOGGING === 'true',
    enableCaching: process.env.ENABLE_CACHING === 'true',
    debug: process.env.DEBUG === 'true'
  },
  
  // Rate Limiting
  rateLimit: {
    windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS, 10) || 15 * 60 * 1000,
    max: parseInt(process.env.RATE_LIMIT_MAX, 10) || 100
  }
};

Using Config in Server:

Code
// server.js
const config = require('./config');
const express = require('express');
const mongoose = require('mongoose');

const app = express();

// Database connection
mongoose.connect(config.db.url, {
  useNewUrlParser: true,
  useUnifiedTopology: true
});

console.log(`Connected to ${config.db.name} database`);

// JWT config
const jwt = require('jsonwebtoken');
const token = jwt.sign({ id: 1 }, config.jwt.secret, {
  expiresIn: config.jwt.expiresIn
});

// Email service
const nodemailer = require('nodemailer');
const transporter = nodemailer.createTransport({
  host: config.email.host,
  port: config.email.port,
  auth: {
    user: config.email.user,
    pass: config.email.pass
  }
});

// Conditional logging
if (config.features.enableLogging) {
  app.use(require('morgan')('dev'));
}

app.listen(config.port, () => {
  console.log(`Server running on port ${config.port}`);
  console.log(`Environment: ${config.nodeEnv}`);
  console.log(`Debug mode: ${config.features.debug}`);
});

6. Different Environments – Development vs Production

Environment-Specific Files:

Code
# Project structure
.env.development      # Development environment
.env.production       # Production environment
.env.staging          # Staging environment
.env.test             # Testing environment
.env.local            # Local overrides (gitignored)

.env.development:

Code
# .env.development
NODE_ENV=development
PORT=3000
DEBUG=true
LOG_LEVEL=debug
DB_HOST=localhost
DB_NAME=dev_db
ENABLE_SWAGGER=true
JWT_EXPIRES_IN=1h

.env.production:

Code
# .env.production
NODE_ENV=production
PORT=8080
DEBUG=false
LOG_LEVEL=error
DB_HOST=cluster.mongodb.net
DB_NAME=prod_db
ENABLE_SWAGGER=false
JWT_EXPIRES_IN=7d

Loading Based on Environment:

Code
// config/env.js
const dotenv = require('dotenv');
const path = require('path');

// Determine which env file to load
const env = process.env.NODE_ENV || 'development';
const envFile = `.env.${env}`;

// Load environment file
dotenv.config({ path: path.resolve(process.cwd(), envFile) });

// Also load .env.local if exists (for local overrides)
dotenv.config({ 
  path: path.resolve(process.cwd(), '.env.local'), 
  override: true 
});

console.log(`Loaded environment: ${env}`);
console.log(`Config file: ${envFile}`);

Running with Different Environments:

Code
// package.json scripts
{
  "scripts": {
    "start": "node server.js",
    "dev": "NODE_ENV=development nodemon server.js",
    "prod": "NODE_ENV=production node server.js",
    "staging": "NODE_ENV=staging node server.js",
    "test": "NODE_ENV=test jest"
  }
}
Code
# Run development
npm run dev

# Run production
npm run prod

# Or manually set
NODE_ENV=production node server.js

7. Validation – Required Variables Check

Basic Validation:

Code
// config/validate.js
require('dotenv').config();

const requiredEnvVars = [
  'PORT',
  'NODE_ENV',
  'DB_HOST',
  'DB_NAME',
  'JWT_SECRET'
];

const missingVars = [];

for (const envVar of requiredEnvVars) {
  if (!process.env[envVar]) {
    missingVars.push(envVar);
  }
}

if (missingVars.length > 0) {
  console.error('❌ Missing required environment variables:');
  missingVars.forEach(varName => {
    console.error(`   - ${varName}`);
  });
  process.exit(1);
}

console.log('✅ All required environment variables are set');

Advanced Validation with Joi:

Code
npm install joi
Code
// config/validation.js
const Joi = require('joi');
require('dotenv').config();

const envSchema = Joi.object({
  // Server
  PORT: Joi.number().default(3000),
  NODE_ENV: Joi.string().valid('development', 'production', 'staging', 'test').default('development'),
  
  // Database
  DB_HOST: Joi.string().required(),
  DB_PORT: Joi.number().default(27017),
  DB_NAME: Joi.string().required(),
  DB_USER: Joi.string().required(),
  DB_PASSWORD: Joi.string().required(),
  
  // JWT
  JWT_SECRET: Joi.string().min(32).required(),
  JWT_EXPIRES_IN: Joi.string().default('7d'),
  
  // Email
  EMAIL_HOST: Joi.string().required(),
  EMAIL_PORT: Joi.number().default(587),
  EMAIL_USER: Joi.string().required(),
  EMAIL_PASS: Joi.string().required(),
  
  // Features
  DEBUG: Joi.boolean().default(false),
  ENABLE_LOGGING: Joi.boolean().default(true)
}).unknown(); // Allow unknown variables

const { error, value } = envSchema.validate(process.env, {
  abortEarly: false
});

if (error) {
  console.error('❌ Environment validation failed:');
  error.details.forEach(detail => {
    console.error(`   - ${detail.message}`);
  });
  process.exit(1);
}

console.log('✅ Environment variables validated successfully');
module.exports = value;

Using Validated Config:

Code
// server.js
const config = require('./config/validation');

console.log('Server Config:', {
  port: config.PORT,
  env: config.NODE_ENV,
  db: `${config.DB_HOST}:${config.DB_PORT}/${config.DB_NAME}`,
  debug: config.DEBUG
});

// Use config values
app.listen(config.PORT, () => {
  console.log(`Server running in ${config.NODE_ENV} mode`);
});

8. Best Practices – Security Tips

Security Checklist:

Code
// ✅ DO's

// 1. Always add .env to .gitignore
// .gitignore
.env
.env.*
!.env.example

// 2. Create .env.example with dummy values
// .env.example
PORT=3000
DB_PASSWORD=your_password_here
JWT_SECRET=your_jwt_secret_here

// 3. Use long, random secrets
const crypto = require('crypto');
const secret = crypto.randomBytes(64).toString('hex');
console.log(secret); // Generate and copy to .env

// 4. Never hardcode defaults for sensitive values
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
  throw new Error('JWT_SECRET is required!');
}

// 5. Validate required variables at startup
require('./config/validate');

// 6. Use different secrets for different environments
// .env.development: JWT_SECRET=dev_secret
// .env.production: JWT_SECRET=prod_very_long_random_secret

// 7. Rotate secrets periodically
// Change JWT_SECRET every 30-90 days

// 8. Use environment-specific configs
const config = {
  development: require('./config/development'),
  production: require('./config/production')
}[process.env.NODE_ENV];

❌ DON’Ts:

Code
// ❌ NEVER hardcode secrets
const API_KEY = 'abc123'; // BIG NO!

// ❌ Never commit .env to GitHub
// Always add to .gitignore

// ❌ Don't use default values for sensitive data
const JWT_SECRET = process.env.JWT_SECRET || 'default_secret'; // BAD!

// ❌ Don't log environment variables
console.log(process.env); // Don't do this!

// ❌ Don't use simple secrets
JWT_SECRET = 'password123'; // Too weak!

// ❌ Don't share .env files via email/Slack
// Use password managers or secure vaults

Production Security Tips:

Code
// config/production.js
module.exports = {
  // Use process manager (PM2) to manage env variables
  // pm2 start server.js --env production
  
  // Use Docker secrets for sensitive data
  // docker secret create db_password ./db_password.txt
  
  // Use cloud secret managers
  // AWS Secrets Manager
  // Azure Key Vault
  // HashiCorp Vault
  
  // For serverless, use environment variables in console
  // AWS Lambda: Environment variables section
  // Vercel: Environment Variables in dashboard
  // Heroku: Config Vars in settings
};

9. Real-world Project Setup

Complete Professional Setup:

Code
// config/index.js
const dotenv = require('dotenv');
const path = require('path');
const Joi = require('joi');

// Load environment file based on NODE_ENV
const env = process.env.NODE_ENV || 'development';
const envFile = `.env.${env}`;

dotenv.config({ path: path.resolve(process.cwd(), envFile) });
dotenv.config({ path: path.resolve(process.cwd(), '.env.local'), override: true });

// Validation schema
const envSchema = Joi.object({
  NODE_ENV: Joi.string().valid('development', 'production', 'staging', 'test').required(),
  PORT: Joi.number().default(3000),
  
  // Database
  DB_HOST: Joi.string().required(),
  DB_PORT: Joi.number().default(5432),
  DB_NAME: Joi.string().required(),
  DB_USER: Joi.string().required(),
  DB_PASSWORD: Joi.string().required(),
  
  // JWT
  JWT_SECRET: Joi.string().min(32).required(),
  JWT_EXPIRES_IN: Joi.string().default('7d'),
  JWT_REFRESH_SECRET: Joi.string().min(32).required(),
  JWT_REFRESH_EXPIRES_IN: Joi.string().default('30d'),
  
  // Redis
  REDIS_URL: Joi.string().required(),
  
  // Email
  EMAIL_HOST: Joi.string().required(),
  EMAIL_PORT: Joi.number().default(587),
  EMAIL_USER: Joi.string().required(),
  EMAIL_PASS: Joi.string().required(),
  EMAIL_FROM: Joi.string().email().required(),
  
  // Stripe
  STRIPE_SECRET_KEY: Joi.string().required(),
  STRIPE_WEBHOOK_SECRET: Joi.string().required(),
  
  // AWS
  AWS_ACCESS_KEY_ID: Joi.string().required(),
  AWS_SECRET_ACCESS_KEY: Joi.string().required(),
  AWS_REGION: Joi.string().default('ap-south-1'),
  AWS_S3_BUCKET: Joi.string().required(),
  
  // Features
  DEBUG: Joi.boolean().default(false),
  ENABLE_SWAGGER: Joi.boolean().default(false),
  CORS_ORIGIN: Joi.string().default('*'),
  
  // Rate Limiting
  RATE_LIMIT_WINDOW_MS: Joi.number().default(15 * 60 * 1000),
  RATE_LIMIT_MAX: Joi.number().default(100)
}).unknown();

// Validate
const { error, value: validatedEnv } = envSchema.validate(process.env, {
  abortEarly: false
});

if (error) {
  console.error('❌ Environment validation failed:');
  error.details.forEach(detail => {
    console.error(`   ${detail.message}`);
  });
  process.exit(1);
}

// Export config
module.exports = {
  env: validatedEnv.NODE_ENV,
  isProduction: validatedEnv.NODE_ENV === 'production',
  isDevelopment: validatedEnv.NODE_ENV === 'development',
  isStaging: validatedEnv.NODE_ENV === 'staging',
  isTest: validatedEnv.NODE_ENV === 'test',
  
  server: {
    port: validatedEnv.PORT,
    corsOrigin: validatedEnv.CORS_ORIGIN
  },
  
  db: {
    host: validatedEnv.DB_HOST,
    port: validatedEnv.DB_PORT,
    name: validatedEnv.DB_NAME,
    user: validatedEnv.DB_USER,
    password: validatedEnv.DB_PASSWORD,
    url: `postgresql://${validatedEnv.DB_USER}:${validatedEnv.DB_PASSWORD}@${validatedEnv.DB_HOST}:${validatedEnv.DB_PORT}/${validatedEnv.DB_NAME}`
  },
  
  jwt: {
    secret: validatedEnv.JWT_SECRET,
    expiresIn: validatedEnv.JWT_EXPIRES_IN,
    refreshSecret: validatedEnv.JWT_REFRESH_SECRET,
    refreshExpiresIn: validatedEnv.JWT_REFRESH_EXPIRES_IN
  },
  
  redis: {
    url: validatedEnv.REDIS_URL
  },
  
  email: {
    host: validatedEnv.EMAIL_HOST,
    port: validatedEnv.EMAIL_PORT,
    auth: {
      user: validatedEnv.EMAIL_USER,
      pass: validatedEnv.EMAIL_PASS
    },
    from: validatedEnv.EMAIL_FROM
  },
  
  stripe: {
    secretKey: validatedEnv.STRIPE_SECRET_KEY,
    webhookSecret: validatedEnv.STRIPE_WEBHOOK_SECRET
  },
  
  aws: {
    accessKeyId: validatedEnv.AWS_ACCESS_KEY_ID,
    secretAccessKey: validatedEnv.AWS_SECRET_ACCESS_KEY,
    region: validatedEnv.AWS_REGION,
    s3Bucket: validatedEnv.AWS_S3_BUCKET
  },
  
  features: {
    debug: validatedEnv.DEBUG,
    enableSwagger: validatedEnv.ENABLE_SWAGGER
  },
  
  rateLimit: {
    windowMs: validatedEnv.RATE_LIMIT_WINDOW_MS,
    max: validatedEnv.RATE_LIMIT_MAX
  }
};

Using the Config:

Code
// server.js
const config = require('./config');
const express = require('express');
const mongoose = require('mongoose');
const redis = require('redis');

const app = express();

// Database connection
mongoose.connect(config.db.url);

// Redis connection
const redisClient = redis.createClient({ url: config.redis.url });

// JWT middleware
const jwt = require('jsonwebtoken');
const token = jwt.sign({ id: 1 }, config.jwt.secret, {
  expiresIn: config.jwt.expiresIn
});

// Conditional features
if (config.features.debug) {
  app.use(require('morgan')('dev'));
}

if (config.features.enableSwagger) {
  const swaggerUi = require('swagger-ui-express');
  app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec));
}

// Rate limiting
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: config.rateLimit.windowMs,
  max: config.rateLimit.max
});
app.use('/api', limiter);

app.listen(config.server.port, () => {
  console.log(`🚀 Server running on port ${config.server.port}`);
  console.log(`📝 Environment: ${config.env}`);
  console.log(`🔧 Debug mode: ${config.features.debug}`);
});

10. Common Mistakes + Solutions

Mistake 1: Forgetting to load dotenv

Code
// ❌ process.env is undefined
const PORT = process.env.PORT; // undefined!

// ✅ Load dotenv at the very top
require('dotenv').config();
const PORT = process.env.PORT;

Mistake 2: Committing .env to GitHub

Code
# ❌ .env committed to git
git add .env
git commit -m "Added env file"

# ✅ Add to .gitignore
echo ".env" >> .gitignore
git add .gitignore
git commit -m "Added .gitignore"

Mistake 3: Not validating required variables

Code
// ❌ App crashes later with cryptic error
const JWT_SECRET = process.env.JWT_SECRET;
// Later: jwt.sign fails with "secret is required"

// ✅ Validate at startup
if (!process.env.JWT_SECRET) {
  throw new Error('JWT_SECRET is required!');
}

Mistake 4: Using default values for secrets

Code
// ❌ Dangerous default
const JWT_SECRET = process.env.JWT_SECRET || 'default_secret';

// ✅ No default for secrets
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) throw new Error('JWT_SECRET required');

Mistake 5: Loading dotenv after other modules

Code
// ❌ Other modules need env vars
const config = require('./config'); // reads process.env
require('dotenv').config(); // too late!

// ✅ Load dotenv FIRST
require('dotenv').config();
const config = require('./config');

11. Quick Cheat Sheet

Installation:

Code
npm install dotenv

Basic Setup:

Code
require('dotenv').config();
const PORT = process.env.PORT || 3000;

.env File:

Code
PORT=3000
NODE_ENV=development
DB_PASSWORD=secret
JWT_SECRET=your_secret_key

Accessing Variables:

Code
const port = process.env.PORT;
const isDev = process.env.NODE_ENV === 'development';
const debug = process.env.DEBUG === 'true';
const timeout = parseInt(process.env.TIMEOUT, 10);

Multiple Environments:

Code
.env.development
.env.production
.env.staging

Loading Specific File:

Code
dotenv.config({ path: '.env.production' });

Validation:

Code
if (!process.env.JWT_SECRET) {
  throw new Error('JWT_SECRET required');
}

12. FAQ

Q1: Express.js environment variables Hindi में सबसे important package kya hai?
dotenv – ye .env file से variables load करता है process.env में।

Q2: .env file ko GitHub par push karna chahiye?
❌ NEVER! Always add .env to .gitignore. Create .env.example for reference.

Q3: Multiple environments ke liye alag .env files kaise use karein?
.env.development, .env.production – और NODE_ENV के according load करो।

Q4: process.env mein variable string mein aata है – number/boolean kaise use karein?
Parse manually: parseInt(process.env.PORT) या process.env.DEBUG === 'true'।

Q5: Required variables kaise validate karein?
Startup par check करो: if (!process.env.JWT_SECRET) throw new Error(...) या Joi library use करो।

Q6: Production mein env variables kaise set karein?
Heroku: heroku config:set KEY=value, AWS: Environment variables in console, Docker: -e KEY=value।

Q7: .env.example kyun banayein?
Team members को बताने के लिए कौन से variables chahiye – dummy values के साथ।

Q8: Kya .env file mein comments likh sakte hain?
Haan, # se start करो – # This is a comment

Q9: .env file mein variables ko expand kar sakte hain?
Haan, ${VAR_NAME} syntax use करो – DB_URL=mongodb://${DB_USER}:${DB_PASSWORD}@localhost

Q10: dotenv ke bina env variables access kar sakte hain?
Haan, system environment variables already process.env में होते हैं। dotenv sirf .env file load करता है।

13. Conclusion

बहुत बढ़िया दोस्तों! आज हमने Express.js environment variables Hindi को पूरी detail में समझा।

Quick Recap:

ConceptKey Takeaway
Environment VariablesSensitive data code से बाहर
dotenv.env file load करने का package
process.envVariables access करने का object
.gitignore.env file ko GitHub से बचाओ
ValidationRequired variables check करो
Multiple Environmentsअलग-अलग configs

Mera personal experience:

Pehle main database password code mein hardcode karta था – ek बार GitHub par push kar diya तो सबको dikh गया। उसके बाद से env variables use karna शुरू कर दिया। अब security ka tension nahi hai।

Tum bhi ye steps follow karo:

  1. ✅ dotenv install करो
  2. ✅ .env file banao
  3. ✅ .gitignore में .env add करो
  4. ✅ .env.example banao (for team)
  5. ✅ Validation add करो

अब तुम्हारी बारी है!

नीचे comment में बताओ:

  1. क्या तुमने कभी code में secret hardcode kiya है?
  2. तुम कौन सा validation method use karoge?
  3. अगला topic क्या चाहिए? (MongoDB with Mongoose? JWT Authentication? File Upload?)

The Easy Master पर बने रहो। Happy Secure Coding! 🔐🚀

Resources

Additional Resources

Post Views: 330
TheEasyMaster

Author at The Easy Master.

Related posts

7. Docker से Node.js App Production Ready Deploy करें 2026
Backend

7. Docker से Node.js App Production Ready Deploy करें 2026

नमस्ते दोस्तों! 🙏स्वागत है The Easy Master पर! क्या तुमने कभी सोचा है – "Mere system par chal raha hai, production mein kyun nahi…

April 21, 2026 15 min read
4. TypeScript Generics in Hindi – बिना डर के लिखो Flexible Code
Backend

4. TypeScript Generics in Hindi – बिना डर के लिखो Flexible Code

स्वागत है The Easy Master पर! क्या तुमने कभी TypeScript में ऐसा code देखा है: function pair<K, V>(key: K, value: V): [K,…

April 8, 2026 11 min read
Virtual Host macOS Homebrew: 7 Easy Steps for Fast Setup
PHP

Virtual Host macOS Homebrew: 7 Easy Steps for Fast Setup

Setting up a virtual host macOS Homebrew environment is one of the smartest ways to improve your local development workflow. Instead of…

March 22, 2026 2 min read

Leave a Reply

Your email address will not be published. Required fields are marked *