Store secrets as host environment variables

My .env file has all my real API keys, and I'm about to push this whole folder to GitHub.

BeginnerRead 4 minDoing: under an hour5 steps

▶ Start

What you'll have at the end

A deployed app with zero secrets in its repo, all of them set on the host instead

Before you start

You need

An app whose real credentials, like a database connection string or a signing secret, sit in a local .env file, its code pushed to a Git repository connected to both a hosting platform and an automated pipeline that runs on every push.

Not covered

Scrubbing a secret that already reached a public commit out of a repository's full history: a real, separate cleanup with its own careful steps.

Leans on

5 steps

Where to go next

Keeping .env secrets out of git

go here first when a real credential has already been pushed at some point, since scrubbing it out of a repository's history is a separate job with its own careful steps

Checked 25 Aug 2026

Part of the Full-Stack Application Deployment cookbook