How to set environment variables in Replit safely

If you have an existing .env file from local development or another platform, open it and copy its contents. Then open the Secrets panel from the Tools dock, click Edit as .env, and paste the contents. This bulk-imports all your environment variables at once. After importing, delete the .env file from your project and remove the dotenv package from your dependencies if present. In Replit, secrets are automatically injected as environment variables, so dotenv is unnecessary and can cause issues if it tries to load a nonexistent .env file.

1# Your existing .env file might look like this:
2DATABASE_URL=postgresql://user:password@host:5432/mydb
3OPENAI_API_KEY=sk-abc123def456
4JWT_SECRET=my-super-secret-jwt-key
5NODE_ENV=production
6PORT=3000
7
8# Steps:
9# 1. Copy the contents above
10# 2. Open Tools > Secrets > Edit as .env
11# 3. Paste and save
12# 4. Delete the .env file from your project
13# 5. Uninstall dotenv: npm uninstall dotenv
14# 6. Remove require('dotenv').config() from your code

If your Node.js entry point includes require('dotenv').config() or import dotenv from 'dotenv', remove these lines. Replit injects secrets as environment variables automatically at runtime, so dotenv is redundant. Leaving dotenv in place can cause errors if it looks for a .env file that no longer exists, or worse, it can load stale values from an old .env file that conflicts with your Secrets panel values. Also remove the dotenv package from package.json to keep your dependencies clean.

1// BEFORE: remove this line
2require('dotenv').config();
3
4// AFTER: no import needed, process.env works directly
5const dbUrl = process.env.DATABASE_URL;
6const port = process.env.PORT || 3000;

Replit automatically sets several environment variables that you do not need to add to Secrets. REPLIT_DEPLOYMENT is set to '1' when the app runs in a deployed environment and is undefined in the workspace. REPLIT_DOMAINS contains the app's domain name. REPL_ID is the unique identifier for your Repl. REPL_SLUG is the project name. REPL_OWNER is your username. REPLIT_DB_URL is the connection URL for Replit's built-in key-value database. REPLIT_DEV_DOMAIN exists only in the workspace for development URLs. Use these in your code to make environment-aware decisions without adding custom secrets.

1// Detect environment
2const isProduction = process.env.REPLIT_DEPLOYMENT === '1';
3
4// Get the current domain (works in both workspace and deployment)
5const domain = process.env.REPLIT_DOMAINS;
6
7// Build URLs dynamically
8const baseUrl = isProduction
9  ? `https://${domain}`
10  : `https://${process.env.REPLIT_DEV_DOMAIN}`;
11
12console.log(`Running at ${baseUrl} (${isProduction ? 'production' : 'development'})`);

Many services provide separate test and production credentials (like Stripe's test vs live keys). In Replit, you manage this by storing test credentials in workspace Secrets and production credentials in deployment Secrets. Your code uses REPLIT_DEPLOYMENT to select the correct configuration. You can also store both sets in workspace Secrets with different names (e.g., STRIPE_TEST_KEY and STRIPE_LIVE_KEY) and select the right one in code. The deployment Secrets override workspace Secrets for any matching key names.

1// config.js — per-environment configuration
2const isProduction = process.env.REPLIT_DEPLOYMENT === '1';
3
4module.exports = {
5  db: {
6    url: process.env.DATABASE_URL,
7    ssl: isProduction,
8  },
9  stripe: {
10    key: isProduction
11      ? process.env.STRIPE_LIVE_KEY
12      : process.env.STRIPE_TEST_KEY,
13  },
14  logging: {
15    level: isProduction ? 'error' : 'debug',
16  },
17  server: {
18    port: parseInt(process.env.PORT || '3000', 10),
19    host: '0.0.0.0',
20  },
21};

When your project has many environment variables, individual entry is tedious. The Secrets panel supports two bulk editing modes. Click Edit as JSON to enter a JSON object where keys are variable names and values are the variable values. Click Edit as .env to enter standard KEY=VALUE format, one per line. Both modes let you add, update, or remove multiple variables at once. This is especially useful when copying configurations between projects or when a team member needs to set up the same environment. For teams managing complex configurations across multiple Replit projects, RapidDev can help establish standardized environment variable workflows.

1// JSON format for bulk editing
2{
3  "DATABASE_URL": "postgresql://user:pass@host:5432/db",
4  "OPENAI_API_KEY": "sk-abc123",
5  "JWT_SECRET": "long-random-string-here",
6  "REDIS_URL": "redis://localhost:6379",
7  "SMTP_HOST": "smtp.sendgrid.net",
8  "SMTP_USER": "apikey",
9  "SMTP_PASS": "SG.xxxxxxxxxxxx",
10  "NODE_ENV": "production"
11}

After setting up your environment variables, create a startup validation routine that checks all required variables are present. This runs when your app starts and immediately tells you if something is missing. Never log actual secret values. Instead, log whether each required secret is set (truthy) or missing. Run your app with the Run button and check the Console output. If any variables are missing, add them in the Secrets panel and restart.

1// startup-check.js — import at the top of your entry point
2const REQUIRED = [
3  'DATABASE_URL',
4  'JWT_SECRET',
5  'OPENAI_API_KEY',
6];
7
8const OPTIONAL = [
9  'SMTP_HOST',
10  'REDIS_URL',
11];
12
13const isProduction = process.env.REPLIT_DEPLOYMENT === '1';
14const context = isProduction ? 'Deployments > Secrets' : 'Tools > Secrets';
15
16const missing = REQUIRED.filter(key => !process.env[key]);
17if (missing.length > 0) {
18  console.error(`\nMissing required env vars (add in ${context}):`);
19  missing.forEach(key => console.error(`  - ${key}`));
20  if (isProduction) process.exit(1);
21}
22
23const missingOptional = OPTIONAL.filter(key => !process.env[key]);
24if (missingOptional.length > 0) {
25  console.warn(`\nOptional env vars not set: ${missingOptional.join(', ')}`);
26}
27
28console.log(`Environment check passed (${isProduction ? 'production' : 'development'})`);