Environment Variables in React
In this page:
# .env file
VITE_VARIABLE_NAME=value
// In component code
const value = import.meta.env.VITE_VARIABLE_NAME;
Defining and Reading Environment Variables
A .env file at your project root defines key-value pairs your build tool reads and makes available to your code. In Vite, client-exposed variables must be prefixed with VITE_, and are accessed via import.meta.env.VITE_SOMETHING in your code.
Example: Defining and Reading Environment Variables
// Run in your local React project (npm install required)
// .env
VITE_API_URL=https://api.example.com
// In your code:
const apiUrl = import.meta.env.VITE_API_URL;
fetch(apiUrl + '/users');
Why Client-Side Variables Are Never Truly Secret
Anything bundled into your client-side JavaScript, including environment variables exposed this way, ends up downloadable and readable by anyone who opens browser devtools and inspects the bundle.
Real secrets (API keys with write access, database credentials) must stay server-side, never in a client-exposed env variable.
Different Values per Environment
Separate .env files (like .env.development and .env.production) let the same codebase automatically use different values — like a local API URL during development and the real production API URL when deployed — without changing any actual code.
Example: Different Values per Environment
// Run in your local React project (npm install required)
// .env.development
VITE_API_URL=http://localhost:4000
// .env.production
VITE_API_URL=https://api.myrealapp.com
// Same code works correctly against both, automatically:
fetch(import.meta.env.VITE_API_URL + '/users');
- Putting genuinely secret values (API secret keys) in a client-side environment variable — anything bundled into client JS is visible to anyone who opens devtools.
- Forgetting the required prefix (like VITE_ or REACT_APP_) that the build tool needs to actually expose a variable to client code.
- Not restarting the dev server after changing a .env file, missing the update since env vars are typically read at build/start time.
- Environment variables let the same code behave differently in development vs. production (like pointing at different API URLs).
- Client-exposed variables need a specific prefix (VITE_ for Vite, REACT_APP_ for Create React App) to actually reach the browser bundle.
- Any variable exposed to client-side code is publicly visible — never put real secrets there.
- Variables are typically defined in .env files, with different files for different environments (.env.production, .env.development).
Build-tool feature (Vite's import.meta.env or Create React App's process.env); no specific React version requirement.
Chapter Quiz — Complete all 13 topics to unlock
0/13 topics done
Complete these topics first:
- Why Performance Matters
- Optimizing with React.memo
- Avoiding Unnecessary Re-renders
- Using the React Profiler
- Analyzing Bundle Size
- Image Optimization Techniques
- React as a PWA
- Creating a Production Build
- Environment Variables in React
- Deploying to Netlify
- Deploying to Vercel
- Basic CI/CD for React Apps
- SEO Basics for React SPAs