An environment variable is a name-value setting supplied by the operating system and read by an application at runtime. In ASP.NET Core, environment variables provide configuration without placing values directly in the project folder. WebApplicationBuilder adds the environment-variable configuration provider by default; AddEnvironmentVariables can add it explicitly. section 10.2.3
Use environment variables to:
- Keep production passwords, connection strings, and API keys out of appsettings.json and source control. section 10.2.3
- Select the hosting environment with ASPNETCORE_ENVIRONMENT; without it, the application defaults to Production. section 10.4.3
- Create hierarchical configuration keys using environment-variable names corresponding to configuration sections. section 10.2.3
- Run the same application with different settings by choosing launchSettings.json profiles or passing an environment at startup. section 10.4.3
Run with a staging environment
Use `dotnet run --no-launch-profile --environment Staging` to start the application in Staging without using a launch profile. For local development, launchSettings.json can assign different environment variables to separate http, https, or IIS Express profiles. section 10.4.3
Figure 10.6 By default, ASP.NET Core applications run in the production hosting environment. You can override this default by setting the ASPNETCORE_ENVIRONMENT variable.
The diagram reinforces the default Production environment and shows that ASPNETCORE_ENVIRONMENT overrides it. section 10.4.3
Environment variables reduce accidental commits, but they are not encrypted: a compromised machine can expose their plain-text values. Use User Secrets locally and consider an encrypted store such as Azure Key Vault for stronger protection; never rely on a private repository as a security boundary. section 10.2.3
