0Pricing
AI Powered SaaS: Stripe + Auth + Billing + Deploy · Lesson

Environment Variables & Secrets Management

Configure your SaaS safely across environments by managing secrets, separating public and private variables, and avoiding leaking keys to the client.

Environment Variables & Secrets Management is a free AI Powered SaaS: Stripe + Auth + Billing + Deploy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AI Powered SaaS: Stripe + Auth + Billing + Deploy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Configuration Matters

A SaaS connects to databases, payment providers, and AI APIs — each with keys that differ per environment. Environment variables keep them out of code so one codebase runs anywhere.

The .env File

Local config lives in a .env file as plain key-value pairs. It's loaded at startup and must never be committed to git.

DATABASE_URL=postgresql://localhost/app
STRIPE_SECRET_KEY=sk_test_123
OPENAI_API_KEY=sk-abc

Never Commit Secrets

Never commit secrets: add .env to .gitignore and ship a .env.example with empty values, so teammates know what to fill in without seeing real keys.

# .gitignore
.env
.env.local

Public vs Private Variables

In Next.js, only variables prefixed NEXT_PUBLIC_ reach the browser bundle — everything else stays server-only. Never prefix a real secret, or every visitor sees it.

NEXT_PUBLIC_APP_URL=https://app.com   # safe in browser
STRIPE_SECRET_KEY=sk_live_xxx          # server only

Reading Variables

Read variables through process.env. Server code can access any of them; client code only ever sees the public, NEXT_PUBLIC_ ones.

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
const url = process.env.NEXT_PUBLIC_APP_URL;

Validating Env at Startup

A missing key should fail fast, not at 2am in production. Validate required variables on boot with a schema like Zod so problems surface immediately.

import { z } from 'zod';
const env = z.object({
  DATABASE_URL: z.string().url(),
  STRIPE_SECRET_KEY: z.string().min(1)
}).parse(process.env);

Per-Environment Files

Next.js loads .env.local, then .env.development or .env.production. These per-environment files keep different values cleanly separated.

Secrets in Hosting Platforms

In production you don't ship a .env file. Set variables in your host's dashboard — Vercel, Render — so they're injected securely at runtime.

vercel env add STRIPE_SECRET_KEY production

Rotating Keys

If a key leaks, rotate it: generate a new one, update your env store, redeploy. Because keys live outside code, rotation is quick and low-risk.

Avoiding Common Leaks

Watch for common leaks: logging full process.env, returning secrets in API responses, hardcoding keys as fallbacks, or committing a real .env.

Best Practices

Best practices: keep secrets in .env and out of git, expose only truly public values with NEXT_PUBLIC_, validate at startup, and store prod secrets in your host.

Quick Check

Test your secrets knowledge.

Recap

Recap: store config in .env and keep it out of git, use NEXT_PUBLIC_ only for safe values, validate at startup, and set prod secrets in your host.

Frequently asked questions

Is the “Environment Variables & Secrets Management” lesson free?

Yes — the full text of “Environment Variables & Secrets Management” is free to read here on the web, and the AI Powered SaaS: Stripe + Auth + Billing + Deploy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AI Powered SaaS: Stripe + Auth + Billing + Deploy course, upgrade to CoddyKit PRO.

What will I learn in “Environment Variables & Secrets Management”?

Configure your SaaS safely across environments by managing secrets, separating public and private variables, and avoiding leaking keys to the client. You practise AI Powered SaaS: Stripe + Auth + Billing + Deploy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AI Powered SaaS: Stripe + Auth + Billing + Deploy?

No prior experience is required. AI Powered SaaS: Stripe + Auth + Billing + Deploy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Environment Variables & Secrets Management” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AI Powered SaaS: Stripe + Auth + Billing + Deploy lesson?

Yes. Every AI Powered SaaS: Stripe + Auth + Billing + Deploy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Intro to SaaS & AI Synergy
  2. Choosing Your Tech Stack
  3. Project Initialization & Structure
  4. Environment Variables & Secrets Management
← Back to AI Powered SaaS: Stripe + Auth + Billing + Deploy