Security News
Weekly Downloads Now Available in npm Package Search Results
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
dotenv-save
Advanced tools
Dotenv loads environment variables from .env
into ENV
(process.env).
"Storing configuration in the environment is one of the tenets of a twelve-factor app. Anything that is likely to change between deployment environments–such as resource handles for databases or credentials for external services–should be extracted from the code into environment variables.
But it is not always practical to set environment variables on development machines or continuous integration servers where multiple projects are run. Dotenv loads variables from a
.env
file into ENV when the environment is bootstrapped."
npm install dotenv --save
As early as possible in your application, require and load dotenv.
require('dotenv').load();
Create a .env
file in the root directory of your project. Add
environment-specific variables on new lines in the form of NAME=VALUE
.
For example:
DB_HOST=localhost
DB_USER=root
DB_PASS=s1mpl3
That's it.
process.env
now has the keys and values you defined in your .env
file.
db.connect({
host: process.env.DB_HOST,
username: process.env.DB_USER,
password: process.env.DB_PASS
});
config
will read your .env file, parse the contents, and assign it to
process.env
- just like load
does. You can additionally, pass options to
config
.
Note: config
and load
are synonyms. You can pass options to either.
Default: .env
You can specify a custom path if your file containing environment variables is named or located differently.
require('dotenv').config({path: '/custom/path/to/your/env/vars'});
Default: utf8
You may specify the encoding of your file containing environment variables using this option.
require('dotenv').config({encoding: 'base64'});
The engine which parses the contents of your file containing environment variables is available to use. It accepts a String or Buffer and will return an Object with the parsed keys and values.
var dotenv = require('dotenv');
var buf = new Buffer('BASIC=basic');
var config = dotenv.parse(buf); // will return an object
console.log(typeof config, config) // object { BASIC : 'basic' }
The parsing engine currently supports the following rules:
BASIC=basic
becomes {BASIC: 'basic'}
#
are treated as commentsEMPTY=
becomes {EMPTY: ''}
)SINGLE_QUOTE='quoted'
becomes {SINGLE_QUOTE: "quoted"}
)MULTILINE='new\nline'
becomes{MULTILINE: 'new
line'}
JSON={"foo": "bar"}
becomes {JSON:"{\"foo\": \"bar\"}"
)Basic variable expansion is supported.
BASIC=basic
TEST=$BASIC
Parsing that would result in {BASIC: 'basic', TEST: 'basic'}
. You can escape
variables by quoting or beginning with \
(e.g. TEST=\$BASIC
). If the
variable is not found in the file, process.env
is checked. Missing variables
result in an empty string.
BASIC=basic
TEST=$TEST
DNE=$DNE
TEST=example node -e 'require("dotenv").config();'
process.env.BASIC
would equal basic
process.env.TEST
would equal example
process.env.DNE
would equal ""
No. We strongly recommend against committing your .env file to version control. It should only include environment-specific values such as database passwords or API keys. Your production database should have a different password than your development database.
Here's just a few of many repositories using dotenv:
FAQs
Loads and saves environment variables from .env file
The npm package dotenv-save receives a total of 89 weekly downloads. As such, dotenv-save popularity was classified as not popular.
We found that dotenv-save demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
Security News
A Stanford study reveals 9.5% of engineers contribute almost nothing, costing tech $90B annually, with remote work fueling the rise of "ghost engineers."
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.