First build · Advanced beginner · Lesson 27 of 98 · about 1 hour
Configuration, environment variables and secrets
After this you can keep credentials out of your repository and run the same code against local and production databases.
Why it matters
Database URLs, API keys and session secrets are configuration, not code. They live in environment variables; `.env` is in `.gitignore` from the first commit; a committed `.env.example` lists the names without values. If you ever commit a secret, rotate it. Deleting the commit is not enough; it is in the history and in every clone.
How to use this resource
From 2011 and still the clearest statement of why configuration belongs in the environment. Two minutes to read.