Node.js Environment Variables

What you will practice

• Understand process.env as runtime configuration.
• Use fallback values safely.
• Recognize secret-handling boundaries.

What this means

Environment variables are configuration values supplied to a running process.

Node.js exposes them through `process.env` in real server code.

They are commonly used for ports, feature flags, database URLs, and secrets, but secrets must never be printed to users or shipped to the browser.

Mini glossary

process.env

Where real Node.js exposes environment variables.

Secret

A sensitive value such as a token, password, or private key.

Fallback

A default value used when configuration is missing.

How it works step by step

1. Create `config.js` and read values from `process.env`.
2. Convert `PORT` from a string to a number.
3. Use fallback values for missing optional configuration.
4. Print only safe summaries, not secret values.

Where you will use this

• A server reads `PORT` to decide which port to listen on.
• A production deployment sets `NODE_ENV=production`.
• A backend stores database credentials outside source code.

Before you run the code

Do not commit `.env` files with real secrets.

Do not expose server-only environment variables to frontend code. In real deployments, configure secrets in the hosting platform or container environment.

Run it locally

These examples are meant for a local Node.js project. Create the files shown below, then run the terminal commands from the project folder.

mkdir lumio-env-demo
cd lumio-env-demo
touch config.js

function readConfig() {
  const port = Number(process.env.PORT || 3000);
  const mode = process.env.NODE_ENV || "development";
  const apiToken = process.env.API_TOKEN;

  return {
    port,
    mode,
    hasApiToken: Boolean(apiToken)
  };
}

const config = readConfig();

console.log(`Mode: ${config.mode}`);
console.log(`Port: ${config.port}`);
console.log(`API token configured: ${config.hasApiToken}`);

NODE_ENV=production PORT=4000 API_TOKEN=demo-token node config.js

$env:NODE_ENV="production"
$env:PORT="4000"
$env:API_TOKEN="demo-token"
node config.js

Common beginner mistakes

• Printing secrets in logs.
• Committing real `.env` files.
• Assuming every environment variable exists and has the right type.

Try changing this next

• Remove `PORT` and check the fallback.
• Change `NODE_ENV` to `development`.
• Print only whether a token exists, not the token value.