.env is a plain text file at the root of the project where you list environment variables, one per line. It stores local configuration and secrets, such as API keys, outside the code.

How it works

Each line follows the format NOME=valor. When the project starts, it uses a library or a built-in framework feature that reads the file and loads those lines as environment variables. The code then reads the values normally.

An example file:

Terminal
OPENAI_API_KEY=sua-chave-aqui
DATABASE_URL=postgres://usuario:senha@localhost:5432/meubanco
PORT=3000

And reading it in Node.js with the dotenv library:

JavaScript · index.js
require("dotenv").config();
console.log(process.env.PORT);

In Python, something similar exists with the python-dotenv library. Many modern frameworks already read .env on their own.

The name starts with a dot, which makes the file hidden by default on Linux and macOS. Use the option to show hidden files to see it.

Practical example

You are creating a bot that uses an AI API. Create .env with the key and add a line to .gitignore:

Terminal
.env

This way Git never sends the file to the repository. To help teammates, you create a .env.example with the same names and fake values, and that one can go to the repository.

When someone else clones the project, they copy the example, rename it to .env and fill in their own keys.

What it's for

It is used to separate secrets from code, make local configuration easier and keep different environments, such as development and production, with distinct values.

Code agent tools and projects with model APIs use .env frequently to receive provider keys.

Cautions

  • Never commit .env. If this happens, consider the key compromised: revoke it and create a new one. Deleting the file later does not remove what remains in Git history.
  • No quotes or spaces around the equals sign, unless the library requires it.
  • In production, prefer the hosting provider's variables panel or a secrets manager, instead of bringing the file to the server.
  • AI agents that read your project can access .env. Restrict permissions and avoid leaving high privilege keys there.