.env Files & Environment Variables

Also Known As

TL;DR

Explanation

The Twelve-Factor App methodology mandates configuration in the environment — database credentials, API keys, and environment-specific settings should never be hardcoded or committed to version control. In development, vlucas/phpdotenv loads a .env file into $_ENV and getenv(). In production, variables are set at the infrastructure level (Docker, Kubernetes secrets, AWS Parameter Store). Always add .env to .gitignore; commit a .env.example with placeholder values. Access variables via $_ENV['KEY'] or getenv('KEY') — prefer $_ENV as it's not affected by php.ini's variables_order.

Watch Out

Common Misconception

Why It Matters

Common Mistakes

• Committing the .env file to version control — the whole point is to keep secrets out of the repo.
• Not providing a .env.example with all required keys — new developers don't know what to configure.
• Loading .env in production when environment variables are already set by the server — causes double-loading conflicts.
• Using $_ENV instead of getenv() or a dotenv library — $_ENV is not populated in all PHP configurations.

Code Examples

// .env committed to git — credentials exposed:
# .gitignore is missing .env entry
DB_PASSWORD=supersecret123
API_KEY=sk-live-abc123
# Anyone with repo access has these credentials

# .env — local secrets, NEVER committed to git
APP_ENV=production
DB_HOST=db.internal
DB_PASS=super_secret_password
STRIPE_SECRET=sk_live_...

# .env.example — template committed to git, no real secrets
APP_ENV=local
DB_HOST=localhost
DB_PASS=
STRIPE_SECRET=

# PHP — vlucas/phpdotenv
\$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
\$dotenv->load();
\$dotenv->required(['DB_HOST', 'DB_PASS', 'APP_KEY']); // fail fast if missing

\$dbPass = \$_ENV['DB_PASS'];

# In production: set env vars at server/container level — don't deploy .env files

References

• ↗ https://12factor.net/config
• ↗ https://github.com/vlucas/phpdotenv

Tags

Related Terms