Express - lesson 6 | HackIndia Skills

Express - lesson 6 | HackIndia Skills | HackIndia

Example

Create env files

Use a real .env file locally. Then create .env.example with fake safe values so a recruiter knows what to set before running your repo.

.env
PORT=3000
NODE_ENV=development
JWT_SECRET=replace-this-locally

.env.example
PORT=3000
NODE_ENV=development
JWT_SECRET=change-me

Example

Read process.env

Keep config in one small file. This makes it easy to check required values when the app starts, instead of failing later during a request.

// src/config.js
export const config = {
  port: process.env.PORT || 3000,
  nodeEnv: process.env.NODE_ENV || 'development',
  jwtSecret: process.env.JWT_SECRET
};

export function checkConfig() {
  const required = ['JWT_SECRET'];

  for (const key of required) {
    if (!process.env[key]) {
      throw new Error(`Missing required environment variable: ${key}`);
    }
  }
}

Example

Start with env

Node.js can load variables from a file before your app starts. Use --env-file for your local run script.

OS environment variables win over values from the env file. That is useful on deployment platforms.

// package.json
{
  "scripts": {
    "dev": "node --env-file=.env src/server.js",
    "start": "node src/server.js"
  }
}

// src/server.js
import express from 'express';
import { config, checkConfig } from './config.js';

checkConfig();

const app = express();

app.get('/health', (req, res) => {
  res.status(200).json({ status: 'ok', env: config.nodeEnv });
});

app.listen(config.port, () => {
  console.log(`API running on port ${config.port}`);
});

Your to-do

Keep secrets out

Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.

Add .env to .gitignore before your first commit.
Commit .env.example, not .env.
Use fake values in screenshots, README files, and demo videos.
Rotate a secret if you accidentally pushed it to GitHub.
Check AI-generated code for hard-coded keys before you paste it.

0 of 5 done

.gitignore
node_modules
.env

Protect Config and Secrets

One rule

What counts as config

Create env files

Read process.env

Start with env

Keep secrets out

Common mistake

Ask AI safely

Do this now

Quick check