Securely Manage API Keys in Node.js with Environment Variables

// 1. Install dotenv: npm install dotenv

// 2. Create a .env file in your project root:
// .env content:
// API_KEY=your_super_secret_api_key_12345
// ANOTHER_API_SECRET=another_secret_value

// 3. Add .env to your .gitignore file to prevent committing secrets:
// .gitignore content:
// .env

// 4. In your Node.js application (e.g., app.js or config.js):
require('dotenv').config();

// Now you can access your environment variables
const myApiKey = process.env.API_KEY;
const anotherSecret = process.env.ANOTHER_API_SECRET;

console.log(`My API Key (should not be undefined): ${myApiKey ? 'Loaded' : 'NOT LOADED - Check .env file and dotenv setup'}`);
console.log(`Another Secret (should not be undefined): ${anotherSecret ? 'Loaded' : 'NOT LOADED'}`);

// Example using an API key in a fetch request:
async function callExternalApi() {
  if (!myApiKey) {
    console.error('API_KEY is not set. Cannot make API call.');
    return;
  }
  try {
    const response = await fetch(`https://api.example.com/data?key=${myApiKey}`); // Use key in URL (less secure for sensitive keys)
    // Or better, pass in headers:
    // const response = await fetch('https://api.example.com/data', {
    //   headers: { 'Authorization': `Bearer ${myApiKey}` }
    // });

    if (!response.ok) {
      throw new Error(`HTTP error! Status: ${response.status}`);
    }
    const data = await response.json();
    console.log('API Response:', data);
  } catch (error) {
    console.error('Error calling external API:', error);
  }
}

// callExternalApi(); // Uncomment to test