An environment variable is a named configuration value supplied to an application rather than hard-coded in its source. In a web application, it can provide API credentials, service URLs, or a simple feature toggle. The important distinction is where the value will be read: server-side code can use secrets, while browser-visible configuration must be safe to disclose. section 2.8.3 section 10.3.2
Configure variables according to the application runtime:
- In Express.js, load a local `.env` file with `dotenv`, then read values through `process.env`. Keep the file out of version control with `.gitignore`. section 2.5.5
- In Next.js, place local values in `.env.local` or `.env`; Next.js loads them into `process.env` without a separate `dotenv` setup. Read secrets only in server-side code, such as API routes. section 2.8.3
- Prefix a variable with `NEXT_PUBLIC_` only when client-side code needs it. Its value is embedded in the browser JavaScript bundle, so never use that prefix for API keys, database credentials, or other secrets. section 2.8.3
Read a server-side API key
For a Next.js server route, set `OPENAI_API_KEY` locally and read it as `process.env.OPENAI_API_KEY`. In an Express backend, a missing-key check can throw `Missing OPENAI_API_KEY environment variable` before the application serves requests. Keep authenticated calls to the provider on the server rather than passing the key to the browser. section 2.8.3 section 2.5.5 section 9.4.2
// .env GEMINI_API_KEY=<GEMINI_AI_SECRET_KEY> UPSTASH_REDIS_REST_URL=<UPSTASH_REDIS_REST_URL> UPSTASH_REDIS_REST_TOKEN=<UPSTASH_REDIS_REST_TOKEN> NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=<NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY> CLERK_SECRET_KEY=<CLERK_SECRET_KEY>
The chat deployment configuration separates server-side Gemini, Upstash, and Clerk secrets from the browser-visible Clerk publishable key. section 9.6.3
For deployment, configure values in the Vercel dashboard instead of hard-coding them in the repository; Vercel can inject them into the application. Environment variables also work as quick feature flags, but a dedicated feature-management service offers more control when rollout must vary by user segment. section 9.4.1 section 10.3.2
