One rule
Secrets do not belong in code. Your API should read config from process.env, and each machine should provide its own values.
This protects things like database URLs, JWT secrets, API keys, ports, and production settings.
What counts as config
Config is anything that may change between your laptop, a teammate’s laptop, and deployment. For this Express API, PORT and NODE_ENV are enough to practise the pattern.
A secret is config that must not be public. Example: payment keys, email passwords, database passwords, and token signing secrets.
Create env files
Use a real .env file locally. Then create .env.example with fake safe values so a recruiter knows what to set before running your repo.
.env
PORT=3000
NODE_ENV=development
JWT_SECRET=replace-this-locally
.env.example
PORT=3000
NODE_ENV=development
JWT_SECRET=change-meRead process.env
Keep config in one small file. This makes it easy to check required values when the app starts, instead of failing later during a request.
// src/config.js
export const config = {
port: process.env.PORT || 3000,
nodeEnv: process.env.NODE_ENV || 'development',
jwtSecret: process.env.JWT_SECRET
};
export function checkConfig() {
const required = ['JWT_SECRET'];
for (const key of required) {
if (!process.env[key]) {
throw new Error(`Missing required environment variable: ${key}`);
}
}
}Start with env
Node.js can load variables from a file before your app starts. Use --env-file for your local run script.
OS environment variables win over values from the env file. That is useful on deployment platforms.
// package.json
{
"scripts": {
"dev": "node --env-file=.env src/server.js",
"start": "node src/server.js"
}
}
// src/server.js
import express from 'express';
import { config, checkConfig } from './config.js';
checkConfig();
const app = express();
app.get('/health', (req, res) => {
res.status(200).json({ status: 'ok', env: config.nodeEnv });
});
app.listen(config.port, () => {
console.log(`API running on port ${config.port}`);
});Keep secrets out
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done
.gitignore
node_modules
.envCommon mistake
Do not write const apiKey = 'real-key-here' in your route file. Even if the repo is private today, it can become public during a hackathon submission.
Also do not depend on only your local .env. A recruiter should see .env.example and know exactly which variables are needed.
Ask AI safely
You can ask ChatGPT or Gemini to draft a config.js file. Do not paste real secrets into the chat.
Check that the answer uses process.env, validates required variables, and does not log secret values to the console.
Do this now
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done