Environment Variables — Secure Configuration

Never hardcode passwords, API keys, or secrets in your code. Use environment variables.

Reading env vars:

import os

api_key = os.environ.get("API_KEY")
db_url = os.environ.get("DATABASE_URL", "sqlite:///default.db")

# Raises error if not set:
required = os.environ["SECRET_KEY"]

Setting env vars:

# Mac/Linux
export API_KEY="your-key-here"

# Windows
set API_KEY=your-key-here

python-dotenv (recommended):

Install: pip install python-dotenv

Create .env file:

API_KEY=your-key-here
DEBUG=True
DATABASE_URL=postgresql://localhost/mydb

from dotenv import load_dotenv
load_dotenv()  # reads .env file
api_key = os.environ.get("API_KEY")

CRITICAL: Add .env to .gitignore. Never commit secrets to version control. Use .env.example to document required variables.

Reference:

Wikipedia: Environment Variable

https://en.wikipedia.org/wiki/Environment_variable