.env file
A .env file is a plain text file, usually named exactly .env, that stores key-value pairs like ANTHROPIC_API_KEY=sk-ant-... so a program can load them as environment variables when it starts. It is a convention, not a built-in feature of any operating system.
Why it matters
Because it is just a text file sitting in a project folder, a .env file can be committed to git by mistake, copied along with a project backup, or read by anything else with access to that folder. It has to be recreated for every new project.
Should I still use .env files for anything?
They are fine for non-secret configuration. For actual credentials, a system like the Keychain avoids the file entirely.
Does adding .env to .gitignore make it safe?
It reduces the risk of a fresh leak, but it does nothing for a copy already committed in an earlier commit.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.