Environment configuration

Twelve-factor apps store config in the environment—ports, database URLs, API keys—not hard-coded in source. Node reads them via process.env.

Patterns

const port = Number(process.env.PORT ?? 3000);
const dbUrl = process.env.DATABASE_URL;
if (!dbUrl) throw new Error('DATABASE_URL required');

.env files (local dev)

dotenv loads .env into process.env during development—never commit secrets. Production injects vars via platform (Docker, Kubernetes, Vercel, Railway).

Validation at startup

Fail fast if required vars missing—better than cryptic errors on first DB call. Libraries like Zod or envalid schema-check env shapes.

Important interview questions and answers

1. Q: NODE_ENV values?
   A: Conventionally development, test, production—frameworks toggle caching and logging verbosity.
2. Q: Secrets in git?
   A: Never—use secret managers, rotate on leak, scan repos with gitleaks.

Self-check

1. Why validate env at startup?
2. Should .env be committed?

Tip: Validate env vars at startup with a schema (e.g. Zod)—fail fast if DATABASE_URL is missing instead of crashing mid-request.