# Environment Variables

Author: Paulo Queiroz
Language: en
Source: https://raggesilver.com/blog/06-environment-variables

Let's make use of environment variables to store sensitive and configuration data.

Before we get started on the code, let's understand what environment variables
are. Environment variables are variables stored outside the code, usually in the
operating system. They are used to store configuration data and can also be used
to store sensitive information.

Here's are two quick examples of environment variables:

```bash
echo $USER
echo $PATH
```

The first command should print the current user's name (or **username**), and
the second should print the system's **path\***. Note, however, that the syntax
to access environment variables may vary depending on the operating system — the
examples above are for Unix-based systems (macOS and Linux).

> \*The system's path is a list of directories where the system looks for
> executables. When you type a command in the terminal, the system looks for
> that command in the directories listed in the PATH variable. If you've
> installed a program, like the Python interpreter, and an error message says
> that the command is not found, it's likely because the directory where the
> program is installed is not in the PATH variable.

These variables are set by the operating system (technically, by the shell, but
that's not important for now). Any program that has access to the environment
can read these variables.

## Environment variables & Python

In Python, you can access environment variables using the `os` module.

```py
import os

user = os.environ.get("USER")
print(f"Hello, {user}")
```

The code above will print the current user's name — at least on macOS and Linux.
If you are using Windows, you may need to use the `USERNAME` environment
variable instead of `USER`.

> Although you technically can, there is hardly ever a good reason to set
> environment variables from your code.

## Sensitive information

You might have come here simply because you've heard that it's good practice to
store secrets and passwords in environment variables as opposed to saving them
in the code. That is correct. You should never store sensitive information in
your code. But why?

**Security**: Storing secrets in code is considered bad practice, because if you
use any sort of version control system (like Git), you will be sharing your
secrets with the world. Even if your repository is private, it's still a bad
idea as your repository could be leaked or someone else could gain access to it.

**Flexibility**: By storing secrets outside the code, you can change which
database or service you are using without having to change the code. Once you
get more experience deploying applications and sharing them with the world,
you'll realize how handy that is.

## Setting environment variables

So far, we've only looked at how to read existing environment variables. This is
not super useful if you're trying to move your database credentials out of your
code. Let's see how to set environment variables.

On Unix-based systems (macOS and Linux), you can set environment variables in
the terminal like this:

```bash
export MY_SECRET=some_password
```

On Windows, you can set environment variables like this:

```
set MY_SECRET=some_password
```

These will be available to any program you run in that terminal session. If you
close the terminal and open a new one, you'll need to set the environment
variables again. Pretty annoying, right?

## Using a .env file

To make things easier, you can use a `.env` file to store your environment
variables. This file is just a text file with key-value pairs, like this:

```
MY_SECRET=some_password
```

> `.env` is the entire file name. The dot at the beginning is not a typo. This
> makes the file hidden on most systems, and that's what we want. This is also a
> convention in the programming world. Most libraries that read environment
> variables from a file will look for a file named `.env`.

> **Important**: You should never commit your `.env` file to your version
> control system — never add this file to Git. This is the whole point of not
> including the secrets in your code. Git has a function called `.gitignore`
> that you can use to tell Git to ignore certain files. You should add `.env` to
> your `.gitignore` file.
>
> Read more about `.gitignore` [here](https://git-scm.com/docs/gitignore).

To read the `.env` file in Python, you can use the `python-dotenv` library. You
can install it using `pip`:

```bash
pip install python-dotenv
```

Here's how you can use it:

```py
from dotenv import load_dotenv
import os

load_dotenv()

db_password = os.getenv("MY_SECRET")
print(db_password)
```

The `load_dotenv()` function reads the `.env` file in the current directory and
sets the environment variables. You can now access the variables using
`os.getenv()`.

Just to be clear, you don't need a `.env` file or the `python-dotenv` library to
use environment variables in Python. That's just a convenient way to set and
read them from a file so that you don't have to set them manually every time you
open a new terminal session.

## Conclusion

Environment variables are a great way to store configuration data and sensitive
information outside your code. They are easy to use and can make your code more
secure and flexible. You can use them to store database credentials, API keys,
and other sensitive information. Just remember to never commit your `.env` file
to Git.