One rule
Your deployed app cannot read your laptop’s .env file. You must add production environment variables in your hosting provider’s dashboard.
The name must match exactly. DATABASE_URL and database_url are different.
What goes in env
Environment variables store values that change between local and production. They also keep secrets out of GitHub.
Common examples are API keys, database URLs, auth secrets, email service keys, payment keys, and public frontend settings like an API base URL.
Do not commit secrets
Never push .env to a public repo. Recruiters can open your repo, and so can anyone else.
If you already pushed a secret, remove it from the service dashboard and create a new key. Deleting the line from GitHub is not enough.
Use a safe example
Keep a sample file in the repo so someone can set up the project. It shows names, not real values.
This is useful for your HackIndia submission because reviewers can see what the app needs.
# .env.example
DATABASE_URL=
NEXTAUTH_SECRET=
NEXT_PUBLIC_API_BASE_URL=
RAZORPAY_KEY_ID=
RAZORPAY_KEY_SECRET=Add them on host
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done
Know public prefixes
Frontend frameworks often treat some env vars as public. In Next.js, variables starting with NEXT_PUBLIC_ can be sent to the browser.
Only put non-secret values there, like a public API URL. Do not put database URLs, auth secrets, or private payment secrets in public variables.
Read env in code
Check the exact names your app reads. Those are the names you must create on the host.
For Node.js apps, process.env reads server-side environment variables.
// server/db.js
const databaseUrl = process.env.DATABASE_URL;
if (!databaseUrl) {
throw new Error("DATABASE_URL is missing");
}
export { databaseUrl };Do this now
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done