Load secrets from a .env file without installing anything

Your API key is sitting in plain text at the top of a file you're about to push to GitHub.

BeginnerRead 4 minDoing: 20 to 30 minutes6 steps

What you'll have at the end

A working app that reads its secret key from a .env file that git never sees

Before you start

You need

A small Node.js script or app with a real API key or password typed directly into the source code, in a repository you have not pushed yet.

Not covered

Removing a secret that already made it into git history, and setting secrets on a server you deploy to later.

Leans on

Keeping .env secrets out of git

when the secret already made it into a commit instead of being caught here first

Store secrets as host environment variables

for getting this same secret onto the server you eventually deploy to

Checked 25 Aug 2026