| Method | Pros | Cons | Use Case | |--------|------|------|----------| | | Simple, developer-friendly, language-agnostic | On-disk, not rotation-friendly, can be leaked | Local development, small projects | | System environment variables | Native, secure (if managed well) | Hard to manage across many variables, no file portability | Production (Docker, PaaS) | | Config files (JSON/YAML/TOML) | Structured, typed | Requires parsing code, can still leak if committed | Complex app config (non-secret) | | Secrets manager | Highly secure, auditable, rotated easily | Overhead, cost, requires network call | Production, large teams, compliance (HIPAA, SOC2) |

Use python-dotenv :

if (!fs.existsSync(envFile)) console.error( Missing $envFile ); process.exit(1);

Here are some best practices to keep in mind when working with .env files:

Some teams maintain a base .env file with sane defaults, then environment-specific files that override only the changed values. For example:

Tools like Vite or Next.js natively detect the running mode. If you run npm run dev , the bundler automatically pulls from the development file. If you run npm run build , it switches to the production parameters without requiring you to manually rewrite any code. Cleaner Codebases

In production environments (like Heroku, AWS, or Vercel), avoid using physical .env files. Instead, use the platform's native environment variable settings for better encryption.

Your app crashes because .env-production lacks a variable that was only defined in .env-development .