Skip to content
OrbixPanel OrbixPanel Tutorials

Environment variables & secrets

Your app needs settings that shouldn’t live in your code — database passwords, API keys, and anything that differs between your laptop and the live server. These are environment variables, and keeping them out of your code is one of the most important habits in deployment.

Code and secrets are kept separate; the app reads secrets from environment variables, which are never committed to Git Your code goes in Git ✓ Secrets (.env) DB_PASSWORD=… API_KEY=… NEVER goes in Git ✗ Running app reads both at run time

What they are

  • An environment variable is a named setting the app reads when it runs: DB_PASSWORD, API_KEY, NODE_ENV, etc.
  • Locally, you usually keep them in a file called .env. Your code reads from it, so the secrets never appear in the code.
  • On the server, you set the same names so the live app gets the right (different) values — e.g. the production database password instead of your local one.

The golden rule: never commit secrets

Add .env to your .gitignore so it’s not pushed to GitHub. Secrets in a repo — even a private one — leak constantly (forks, logs, old history) and get abused within minutes. Treat an API key like a password.

.gitignore
.env

If you ever paste a real key, password, or token somewhere public — rotate it. Once it’s been exposed, assume it’s compromised and generate a new one.

Set them in OrbixPanel

For a deployed app:

  1. Open the app → Environment Variables.
  2. Paste your settings as KEY=value lines: 
    NODE_ENV=production
    DATABASE_URL=mysql://user:pass@127.0.0.1:3306/mydb
    API_KEY=sk_live_…
  3. Save & restart. OrbixPanel stores them encrypted and injects them into your app. PORT is provided for you.

Tips

  • Don’t hard-code a password or key directly in your source — read it from an env var, even for “just testing.”
  • Different values per environment: your .env locally, the panel’s env editor on the server. Same names, different secrets.
  • A frontend (React/Vite) can’t hide secrets — anything baked into a browser app is visible to visitors. Keep real secrets on the server/API side only.

Next: Users, passwords & 2FA →