How to Securely Store API Keys in Node.js (The Right Way with process.env)

npm install dotenv

# .env — local secrets only, never commit
STRIPE_SECRET_KEY=sk-test-YOUR_KEY
OPENAI_API_KEY=sk-proj-abc123...
DATABASE_URL=postgresql://postgres:mypassword@localhost:5432/myapp
JWT_SECRET=super-secret-jwt-signing-key-at-least-32-chars
WEBHOOK_SECRET=whsec_abc123...

# .gitignore
.env
.env.local
.env.*.local
.env.production

# DO commit this — it documents required variables without values
# .env.example is safe to commit

# .env.example — safe to commit, documents required variables
STRIPE_SECRET_KEY=sk-test-YOUR_KEY_HERE
OPENAI_API_KEY=sk-proj-your_key_here
DATABASE_URL=postgresql://user:password@localhost:5432/dbname
JWT_SECRET=at-least-32-characters-random-string
WEBHOOK_SECRET=whsec_your_webhook_secret

// server.js or app.js — first line in the file
require('dotenv').config(); // Must be before any other imports that use process.env

const express = require('express');
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const { OpenAI } = require('openai');

const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY, // reads from process.env
});

const app = express();
// ...

// config/secrets.js — validate and export secrets
require('dotenv').config();

function requireEnv(name) {
  const value = process.env[name];
  if (!value) {
    throw new Error(
      `Missing required environment variable: ${name}\n` +
      `Copy .env.example to .env and fill in the values.`
    );
  }
  return value;
}

module.exports = {
  stripeSecretKey: requireEnv('STRIPE_SECRET_KEY'),
  openaiApiKey: requireEnv('OPENAI_API_KEY'),
  databaseUrl: requireEnv('DATABASE_URL'),
  jwtSecret: requireEnv('JWT_SECRET'),
  // Optional with default
  port: process.env.PORT || '3000',
  nodeEnv: process.env.NODE_ENV || 'development',
};

// routes/payments.js
const { stripeSecretKey } = require('../config/secrets');
const stripe = require('stripe')(stripeSecretKey);

// If STRIPE_SECRET_KEY is missing, the app crashes at startup
// with a clear error message — not when the first payment is attempted

// lib/env.ts
import { z } from 'zod';

const envSchema = z.object({
  STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
  OPENAI_API_KEY: z.string().startsWith('sk-'),
  DATABASE_URL: z.string().url(),
  JWT_SECRET: z.string().min(32),
  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
});

// This throws at build time / server start if validation fails
const parsed = envSchema.safeParse(process.env);

if (!parsed.success) {
  console.error('Invalid environment variables:', parsed.error.flatten().fieldErrors);
  throw new Error('Invalid environment variables — see above for details');
}

export const env = parsed.data;

// Usage:
// import { env } from '@/lib/env';
// const stripe = new Stripe(env.STRIPE_SECRET_KEY);

// Phase 1: Add the NEW key alongside the OLD key in environment variables
// .env / platform env vars:
// STRIPE_SECRET_KEY=sk_live_OLD_KEY
// STRIPE_SECRET_KEY_NEW=sk_live_NEW_KEY

// In your code, support both during transition:
function getStripeClient() {
  // Try new key first, fall back to old key
  const key = process.env.STRIPE_SECRET_KEY_NEW || process.env.STRIPE_SECRET_KEY;
  return new Stripe(key!);
}

// Phase 2: Deploy. Both keys are valid. Verify new key works in production.

// Phase 3: Remove STRIPE_SECRET_KEY_OLD from env vars.
// Set STRIPE_SECRET_KEY=sk_live_NEW_KEY
// Remove STRIPE_SECRET_KEY_NEW

// Phase 4: Deploy again. Rotation complete, zero downtime.

// Support multiple webhook secrets during rotation
const webhookSecrets = [
  process.env.STRIPE_WEBHOOK_SECRET_NEW,
  process.env.STRIPE_WEBHOOK_SECRET_OLD,
].filter(Boolean) as string[];

function verifyWebhook(payload: Buffer, signature: string) {
  for (const secret of webhookSecrets) {
    try {
      return stripe.webhooks.constructEvent(payload, signature, secret);
    } catch {
      // Try next secret
    }
  }
  throw new Error('Webhook signature verification failed');
}

# Install git-secrets (prevents committing secrets)
brew install git-secrets  # macOS
git secrets --install     # installs pre-commit hook
git secrets --register-aws  # adds AWS key patterns

# Add custom patterns for your keys:
git secrets --add 'sk_live_[a-zA-Z0-9]+'        # Stripe live keys
git secrets --add 'sk-proj-[a-zA-Z0-9]+'        # OpenAI keys
git secrets --add 'sk-ant-[a-zA-Z0-9-]+'        # Anthropic keys

# Now any commit containing these patterns will be blocked

# TruffleHog — scan git history for secrets that already leaked
pip install trufflehog
trufflehog git file://. --only-verified

# Or scan a remote repo:
trufflehog github --repo=https://github.com/yourorg/yourrepo

# GitHub Secret Scanning
# Enabled automatically for public repos
# Enable for private repos: Settings > Code security > Secret scanning
# GitHub will alert you when a known secret pattern is detected in pushes

# Install Husky
npm install --save-dev husky
npx husky init

# .husky/pre-commit
#!/bin/sh
# Run git-secrets check before every commit
git secrets --scan || exit 1

# Also useful: detect-secrets (Python)
pip install detect-secrets
detect-secrets scan > .secrets.baseline
# Add to pre-commit: detect-secrets-hook --baseline .secrets.baseline