# .env file

Canonical page: /glossary/env-file

API keys & secrets glossary, Keys & secrets. .env File: What It Does and Where It Goes Wrong

**Short answer:** A .env file is a plain text file, usually named exactly .env, that stores key-value pairs like ANTHROPIC_API_KEY=sk-ant-... so a program can load them as environment variables when it starts. It is a convention, not a built-in feature of any operating system.

## Why it matters

Because it is just a text file sitting in a project folder, a .env file can be committed to git by mistake, copied along with a project backup, or read by anything else with access to that folder. It has to be recreated for every new project.

## In Claude Keychain

Claude Keychain replaces the .env file for API keys used with Claude Code: you store the key once, in the macOS Keychain, and any project can use it without having its own copy of the file.

## Common questions

**Should I still use .env files for anything?**

They are fine for non-secret configuration. For actual credentials, a system like the Keychain avoids the file entirely.

**Does adding .env to .gitignore make it safe?**

It reduces the risk of a fresh leak, but it does nothing for a copy already committed in an earlier commit.

## Related

[dotenv](/glossary/dotenv), [Secret leaked in git history](/glossary/secret-in-git-history), [.gitignore](/glossary/gitignore)