terminal keyboard code

Photo by Myburgh Roux on Pexels

We’ve all been there: it’s 2 AM, you’re high on caffeine, you push a quick bug fix to GitHub, and—bam—you’ve accidentally hardcoded your AWS master key and production database password into the repo. Instead of panic-sweating, today we’re fixing this once and for all by mastering .env files, environment variables, and the fine art of keeping your credentials out of public view.

Welcome back to the Old Lane 17 workshop. Today, we are ditching enterprise bloatware and opting for clean, terminal-driven workflows that respect your time and your cloud budget.

The Problem: Hardcoding Is a Gateway Drug

It starts innocently enough. You write a quick Python script to fetch the weather or query a database, and you drop your API key right into the source code like a digital sticky note.

python
# bad_practice.py
API_KEY = "super_secret_api_key_12345"

def connect():
    print(f"Connecting with {API_KEY}...")

Sure, it works on your machine. But the moment you push this to a public repository (or even a messy internal one), automated scrapers will harvest that key within seconds. Before you can grab your morning coffee, your cloud provider is billing you for a crypto-mining cluster in Mumbai.

Let’s fix this using .env files and standard environment variables.

Step 1: Create a Clean .env File

In the root directory of your project, create a file named .env. This file will hold your secrets as simple key-value pairs. No complex syntax required.

bash
# .env
DATABASE_URL=postgres://user:password@localhost:5432/myapp
STRIPE_API_KEY=sk_test_51MockKeyDoNotUse
DEBUG_MODE=True

Now, make sure this file is never tracked by Git. Open your .gitignore file and add .env immediately:

bash
# .gitignore
.env
__pycache__/
venv/

If you already committed a .env file in the past, don’t panic. You can scrub it from your Git history, but for now, let’s look at how to actually read these values cleanly in our code without adding heavy dependencies.

Step 2: Load Variables in Python

While you could write custom file parsers, Python developers have the python-dotenv package. It’s lightweight, incredibly reliable, and keeps your code clean.

First, install it via your terminal:

bash
pip install python-dotenv

Now, write your application code to pull variables safely from the environment using os.getenv(). If a variable is missing, your app should gracefully fail or default safely rather than guessing.

python
# main.py
import os
from dotenv import load_dotenv

# Load variables from the .env file into environment variables
load_dotenv()

DATABASE_URL = os.getenv("DATABASE_URL")
DEBUG_MODE = os.getenv("DEBUG_MODE", "False").lower() == "true"

if not DATABASE_URL:
    raise ValueError("CRITICAL: DATABASE_URL is missing from the environment!")

def main():
    print(f"Starting application in debug mode: {DEBUG_MODE}")
    print(f"Connecting to database...")

if __name__ == "__main__":
    main()

Step 3: The Gotcha – Overriding Production Environments

Here is a classic gotcha: You run your app in production using system environment variables, but a stray .env file sitting on the server silently overrides your production settings because load_dotenv() looks in the current directory by default.

To avoid this headache, only load .env files if you are explicitly in a development environment:

python
import os
from dotenv import load_dotenv

# Only load .env if we are not in production
if os.getenv("ENVIRONMENT") != "production":
    load_dotenv()

Keep your terminal clean, keep your credentials local, and may your builds always pass on the first try.

Published by the Old Lane Developer Desk.

Disclaimer: This article was generated and formatted with the assistance of Artificial Intelligence.