What is environment variables?

Technical definition

Environment variables are key-value pairs supplied to an application by its runtime environment rather than defined in its source. They hold configuration that varies by environment, including database connection strings, API keys, service URLs, and feature flags.

The critical distinction in web applications is between server-side and client-side variables. A server-side variable stays on the server. A variable exposed to the browser, which frameworks mark with a prefix such as PUBLIC_ or NEXT_PUBLIC_, is compiled into the JavaScript bundle and is readable by anyone using your site.

A prefixed variable is not a secret. It never was.

In plain terms

An environment variable is a setting kept outside your code, so you can change it without editing the app and so secrets do not end up in your files.

The trap: some of them get bundled into the code your visitors download. Those are public, whatever you called them.

Why it matters

Exposed API keys are one of the most common security flaws in AI-built applications, and environment variables are the fix.

A key written directly into code goes wherever that code goes: into your Git repository, into your deployed bundle, into the browser of anyone who visits. There are automated scanners that find keys in public repositories within minutes of a push, and they are used by people who are not being helpful.

The rules that cover most of it. Anything that grants access or costs money is server-side only, which includes payment secret keys, database credentials, and AI model API keys. Never commit a secrets file. And treat any variable marked for client-side use as published, because it is.

The second reason to use them is practical rather than security-related. Environment variables are how the same code runs against test services in development and real ones in production, which is what keeps you from testing against live customer data.