Environment variables and secrets for your app

Keep API keys, database URLs and other secrets out of your source code. On Schokr you can pass them to your app through variables in your server's Startup settings (where the template exposes them) or through a .env file that your app loads at startup.

Option 1: Startup settings variables#

Your server's Startup settings show the variables the template lets you edit, such as the main file or extra arguments. Use these for things the template supports. Which variables appear depends on the template, so if there is no field for your own secret, use a .env file instead.

Option 2: a .env file#

Create a file named .env in your app's folder with the file manager:

APP_PORT=25571
DISCORD_TOKEN=paste-your-token-here
DATABASE_URL=postgres://user:pass@db.example.com:5432/app

Then load it in your code.

Node.js

Node.js 20.6 and later can load it natively:

node --env-file=.env index.js

Or use the dotenv package on any version:

require('dotenv').config()
console.log(process.env.APP_PORT)

Bun

Bun loads .env from the working directory automatically. Read values with process.env.NAME or Bun.env.NAME.

Python

Install python-dotenv (add it to requirements.txt) and load it before reading values:

import os
from dotenv import load_dotenv

load_dotenv()
token = os.environ["DISCORD_TOKEN"]

Keep secrets safe#

• Never commit .env to Git. Add it to .gitignore:

.env

• Ship a .env.example with empty values so you remember which keys are needed.
• Anyone on your team with file manager access can read .env. Use team roles to limit the files permission to people you trust.
• If a token leaks (for example, pushed to a public repo), revoke it with the provider immediately and create a new one. Deleting the commit is not enough.

Fail fast on missing values#

Crash with a clear message instead of running half-configured:

for (const key of ['DISCORD_TOKEN', 'APP_PORT']) {
  if (!process.env[key]) throw new Error(`Missing env var ${key}`)
}

missing = [k for k in ("DISCORD_TOKEN", "APP_PORT") if not os.environ.get(k)]
if missing:
    raise SystemExit(f"Missing env vars: {missing}")

The error will appear in the console, which makes misconfiguration easy to spot. See reading your app's logs.