{"id":4507,"date":"2026-10-04T04:52:43","date_gmt":"2026-10-04T02:52:43","guid":{"rendered":"https:\/\/nguenkam.com\/blog\/?p=4507"},"modified":"2026-10-04T04:56:38","modified_gmt":"2026-10-04T02:56:38","slug":"environment-variables-the-complete-beginners-guide","status":"publish","type":"post","link":"https:\/\/nguenkam.com\/blog\/index.php\/2026\/10\/04\/environment-variables-the-complete-beginners-guide\/","title":{"rendered":"Environment Variables \u2014 The Complete Beginner’s Guide"},"content":{"rendered":"\n

No more hardcoded passwords. No more leaked API keys. Just clean, secure, professional code.<\/em><\/p><\/blockquote>\n\n\n\n

\n\n\n\n

What is an Environment Variable?<\/h4>\n\n\n\n

Imagine you have a secret notebook<\/strong> that only your computer can read.
You write your passwords, API keys, and configuration values in it.
Your apps can look up those values anytime \u2014 without you writing them directly in your code.<\/p>\n\n\n\n

That notebook is your environment variables store<\/strong>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\n\n\n\n

How to Name Your Variables<\/h4>\n\n\n\n

The standard convention: SCREAMING_SNAKE_CASE<\/code><\/h4>\n\n\n\n
  • All UPPERCASE<\/strong><\/li>
  • Words separated by underscores<\/strong> _<\/code><\/li>
  • No spaces, no hyphens<\/li><\/ul>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    The naming pattern: SERVICE_CATEGORY_DETAIL<\/code><\/h3>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    \"\" Rule of thumb:<\/strong> Read it left to right \u2014 it should tell a story.
    OPENAI_API_KEY<\/code> = “The API key for OpenAI”<\/em> ?<\/p><\/blockquote>\n\n\n\n

    \n\n\n\n

    How to Create an Environment Variable<\/h4>\n\n\n\n

    On Windows \u2014 CMD (Permanent)<\/h4>\n\n\n\n
    # setx = permanent, survives reboot<\/span>\nsetx OPENAI_API_KEY \"sk-proj-your-key-here\"\n\n# Success message:\n# ERFOLGREICH: Angegebener Wert wurde gespeichert.<\/code><\/pre>\n\n\n\n
    On Windows \u2014 CMD (Temporary, current session only)<\/h4>\n\n\n\n
    # set = temporary, lost when terminal closes<\/span>\nset OPENAI_API_KEY=sk-proj-your-key-here<\/code><\/pre>\n\n\n\n
    On macOS \/ Linux (Permanent)<\/h4>\n\n\n\n
    # Add to your shell profile (~\/.bashrc or ~\/.zshrc)\necho 'export OPENAI_API_KEY=\"sk-proj-your-key-here\"' >> ~\/.zshrc\n\n# Reload the profile\nsource ~\/.zshrc<\/code><\/pre>\n\n\n\n
    \"\" Important on Windows with setx<\/code>:<\/strong>
    The variable is saved, but NOT available in the current terminal<\/strong>.
    You must close and reopen<\/strong> a new terminal to use it.<\/p><\/blockquote>\n\n\n\n
    \n\n\n\n
    How to Read \/ Verify a Variable<\/h4>\n\n\n\n
    In CMD (Windows)<\/h4>\n\n\n\n
    # Read one specific variable\necho %OPENAI_API_KEY%\n# -> sk-proj-abc123...\n\n# Search all variables starting with \"OPENAI\"\nset OPENAI\n# -> OPENAI_API_KEY=sk-proj-abc123...\n\n# List ALL environment variables\nset<\/code><\/pre>\n\n\n\n
    In PowerShell<\/h4>\n\n\n\n
    # Read one variable\n$env:OPENAI_API_KEY\n# -> sk-proj-abc123...\n\n# List all variables\nGet-ChildItem Env:\n\n# Filter by name\nGet-ChildItem Env: | Where-Object { $_.Name -like \"OPENAI*\" }<\/code><\/pre>\n\n\n\n
    In Git Bash \/ Linux \/ macOS<\/h4>\n\n\n\n
    # Read one variable\necho $OPENAI_API_KEY\n# -> sk-proj-abc123...\n\n# List all variables\nenv\n\n# Filter with grep\nenv | grep OPENAI<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    How to Use a Variable in Your Code<\/h4>\n\n\n\n
    Java (Spring Boot)<\/h4>\n\n\n\n
    \/\/ Read directly from the system\nString apiKey = System.getenv(\"OPENAI_API_KEY\");<\/code><\/pre>\n\n\n\n
    \/\/ Or inject via Spring @Value\n@Value(\"${OPENAI_API_KEY}\")\nprivate String apiKey;<\/code><\/pre>\n\n\n\n
    TypeScript \/ JavaScript (Node.js)<\/h4>\n\n\n\n
    \/\/ Read from environment\nconst apiKey = process.env.OPENAI_API_KEY;\n\n\/\/ With a fallback default value\nconst apiKey = process.env.OPENAI_API_KEY ?? 'default-key';<\/code><\/pre>\n\n\n\n
    Python<\/h4>\n\n\n\n
    import os\n\napi_key = os.getenv(\"OPENAI_API_KEY\")\n# or\napi_key = os.environ[\"OPENAI_API_KEY\"]<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    How to Use Variables in Config Files<\/h4>\n\n\n\n
    In a .env<\/code> file (most common approach)<\/h4>\n\n\n\n
    Create a .env<\/code> file at the root of your project:<\/p>\n\n\n\n
    # .env\nOPENAI_API_KEY=sk-proj-your-key-here\nDATABASE_URL=postgres:\/\/user:password@localhost:5432\/mydb\nJWT_SECRET=my-super-secret-token\nPORT=3000<\/code><\/pre>\n\n\n\n
    \"\" NEVER commit .env<\/code> to Git!<\/strong>
    Always add it to .gitignore<\/code>:<\/p>\n\n\n\n
    echo \".env\" >> .gitignore<\/code><\/pre>\n\n\n\n
    In VSCode settings.json<\/code><\/h4>\n\n\n\n
    {\n  \"chatgpt.gpt3.apiKey\": \"${env:OPENAI_API_KEY}\"\n}<\/code><\/pre>\n\n\n\n
    In a Spring Boot application.yml<\/code><\/h4>\n\n\n\n
    openai:\n  api-key: ${OPENAI_API_KEY}\n\nspring:\n  datasource:\n    url: ${DATABASE_URL}\n    password: ${DATABASE_PASSWORD}<\/code><\/pre>\n\n\n\n
    In a Docker docker-compose.yml<\/code><\/h4>\n\n\n\n
    services:\n  app:\n    image: my-app\n    environment:\n      - OPENAI_API_KEY=${OPENAI_API_KEY}\n      - DATABASE_URL=${DATABASE_URL}<\/code><\/pre>\n\n\n\n
    In a Kubernetes \/ OpenShift Secret<\/h4>\n\n\n\n
    apiVersion: v1\nkind: Secret\nmetadata:\n  name: app-secrets\ntype: Opaque\nstringData:\n  OPENAI_API_KEY: \"sk-proj-your-key-here\"<\/code><\/pre>\n\n\n\n
    Then reference it in your deployment:<\/p>\n\n\n\n
    env:\n  - name: OPENAI_API_KEY\n    valueFrom:\n      secretKeyRef:\n        name: app-secrets\n        key: OPENAI_API_KEY<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    The Full Workflow \u2014 From Creation to Usage<\/strong><\/span><\/h4>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \n\n\n\n
    Security Best Practices<\/strong><\/span><\/h4>\n\n\n\n
    \"\" DO<\/th>\"\" DON’T<\/th><\/tr><\/thead>
    Store secrets in env variables<\/td>Hardcode secrets in source code<\/td><\/tr>
    Add .env<\/code> to .gitignore<\/code><\/td>Commit .env<\/code> to Git<\/td><\/tr>
    Use Vault or K8s Secrets in production<\/td>Use setx<\/code> in production servers<\/td><\/tr>
    Rotate keys regularly<\/td>Share keys in Slack \/ email<\/td><\/tr>
    Use different keys per environment<\/td>Use the same key in dev & prod<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    Real-World Examples<\/h4>\n\n\n\n
    Variable Name<\/th>What it stores<\/th><\/tr><\/thead>
    OPENAI_API_KEY<\/code><\/td>OpenAI API secret key<\/td><\/tr>
    DATABASE_URL<\/code><\/td>PostgreSQL full connection string<\/td><\/tr>
    DATABASE_PASSWORD<\/code><\/td>Database password only<\/td><\/tr>
    VAULT_TOKEN<\/code><\/td>HashiCorp Vault auth token<\/td><\/tr>
    ARGOCD_AUTH_TOKEN<\/code><\/td>ArgoCD API token<\/td><\/tr>
    JWT_SECRET<\/code><\/td>JWT signing secret<\/td><\/tr>
    AWS_ACCESS_KEY_ID<\/code><\/td>AWS access key<\/td><\/tr>
    SPRING_PROFILES_ACTIVE<\/code><\/td>Active Spring Boot profile (dev\/prod)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    Key Takeaways<\/h4>\n\n\n\n
    1. Environment variables = your app’s secret notebook<\/strong><\/li>
    2. setx<\/code><\/strong> = permanent on Windows \/ export<\/code><\/strong> = permanent on Linux\/Mac<\/li>
    3. Always close and reopen<\/strong> your terminal after setx<\/code><\/li>
    4. set OPENAI<\/code><\/strong> is just a search filter \u2014 the real name is OPENAI_API_KEY<\/code><\/li>
    5. Never hardcode secrets<\/strong> \u2014 if it’s sensitive, it belongs in an env variable<\/li><\/ol>\n","protected":false},"excerpt":{"rendered":"
      No more hardcoded passwords. No more leaked API keys. Just clean, secure, professional code. What is an Environment Variable? Imagine you have a secret notebook that only your computer can read.You write your passwords, API keys, and configuration values in it.Your apps can look up those values anytime \u2014 without you writing them directly in […]<\/p>\n","protected":false},"author":1,"featured_media":4512,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1038,953,221],"tags":[172,1175,1174,93,238,1172,1171,527,1173,927,1176],"_links":{"self":[{"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/4507"}],"collection":[{"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=4507"}],"version-history":[{"count":5,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/4507\/revisions"}],"predecessor-version":[{"id":4518,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/4507\/revisions\/4518"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/media\/4512"}],"wp:attachment":[{"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=4507"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=4507"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nguenkam.com\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=4507"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}