8. Development Best Practices
To avoid these issues in the future, follow these team conventions:
1. Maintain .env.example
Always commit a .env.example file to your repository. This file should list all required environment variables but without the actual secret values.
# .env.example
NEXT_PUBLIC_API_URL=https://api.dev.example.com
DB_PASSWORD=
STRIPE_SECRET_KEY=
This helps new team members set up their local environment quickly without guessing which keys are needed.
2. Use a Secret Manager
For production, avoid managing .env files manually on the server. Use a Secret Manager (AWS Secrets Manager, Vercel Environment Variables, GitHub Secrets).
This ensures that secrets are injected securely during the build or runtime process, reducing the risk of human error (like pasting a key with a trailing space).
3. Consistency checks
Add a script to your package.json to verify that .env aligns with .env.example. Tools like dotenv-safe can automate this, preventing the app from starting if a required variable is missing.
Environment variables are the configuration backbone of your application. Treating them with the same care as your source code will save you countless hours of debugging in the long run.