Environment variables store configuration outside code: API keys, database URLs, feature flags, and service endpoints. They separate config from code.
.env files for local development: .env.local, .env.development, .env.production. Add .env* to .gitignore — never commit secrets.
Next.js reads .env.local for all environments, .env.development for dev, .env.production for build. Variables prefixed with NEXT_PUBLIC_ are exposed to the browser.
Secret management: Vercel env vars, AWS Secrets Manager, HashiCorp Vault for production. Rotate secrets regularly.
Common mistakes: hardcoding secrets, exposing private keys in client bundles, committing .env files, sharing production credentials in chat.
Type safety: use types like process.env.DATABASE_URL with TypeScript declarations. Validate required variables at startup with zod.
十二 factor app methodology: store config in environment, separate from code.