Environment Variable
An environment variable is a named value that the operating system holds ready outside of a program, which the program can query at startup. This allows settings and passwords to be changed without touching the program code itself.
Every program on a computer runs in an environment. This environment is a list of values that the operating system manages and hands to the program at startup. Each entry in this list has a name and a content, for example the name LANGUAGE and the content “english”. Exactly such an entry is called an environment variable. The program can read these values and act accordingly. The advantage: you change the behavior of the program without changing the text from which the program was built.
Why passwords don’t belong in source code
Almost every piece of software needs details that aren’t the same everywhere. On a developer’s laptop the database is located somewhere different than on the server in the data center. If you hard-code such details into the source code, i.e. into the instructions written by humans, you need a separate version of the program for each environment. This is tedious and error-prone. With environment variables, a single version suffices, one that behaves differently depending on the environment.
Even more important is the security aspect. Credentials like API keys are passwords with which a program logs into a third-party service. A key for an AI model, for instance, costs real money with every use. If such a key is written into the source code, it gets uploaded along with everything else as soon as someone pushes the code to a public platform like GitHub. Such accidents happen regularly, and automated search tools find the keys within minutes. If the key instead resides in an environment variable, it never leaves the respective machine.
A common misconception, however, is that environment variables are a vault. They are not. Anyone with access to the running process or the server can usually read them out. So they protect against exposure, not against a break-in.
From the shell to the container
Environment variables are usually set on the command line, i.e. the text window in which you type commands directly. On Linux and macOS you’d write something like export API_KEY=abc123, on Windows the command is called set. If you then start a program, it automatically inherits these values. The program queries them via a built-in function, in the Python language for example via os.environ. If it finds nothing, a preset default value usually kicks in.
Because typing in many values becomes tedious, developers often create a file called .env. It contains one name and one value per line. A small helper program reads this file at startup and sets the variables from it. This file is deliberately excluded from version control, i.e. from the system that stores and shares all code changes. This is precisely what keeps it local.
The scope matters: environment variables only apply to the process that received them and to its subprocesses. If you close the terminal window, they’re gone, unless you’ve stored them permanently. It is precisely this short lifespan that makes them practical for servers, which are freshly configured on every restart.
Where they show up in AI projects
Anyone addressing an AI model via an interface for the first time will almost certainly stumble upon an environment variable. The instructions from providers like OpenAI or Anthropic typically begin with the sentence that you should set OPENAI_API_KEY or ANTHROPIC_API_KEY. The program library then searches for this name on its own. If it’s missing, the program aborts with an error message that points exactly to this.
This is also the standard outside of small hobby projects. In Docker containers, i.e. self-contained packages for software, configuration and credentials are passed in almost exclusively via environment variables. Cloud providers offer their own input fields for this in their management interface. For particularly sensitive values, there are additionally so-called secret managers, which store secrets encrypted and only deliver them at startup.
In the news, environment variables usually come up when something went wrong. Reports about leaked API keys or .env files openly accessible on the internet are not uncommon. The technology itself is unspectacular and decades old. But it is the point at which, in many projects, security is decided.