title: Why and how to put secrets in environment variables in Node.js?
body: <p>I'm relatively new to Node.js and Express and I was following a guide on adding authentication using JWT to my site found here: <a href="https://medium.com/dev-bits/a-guide-for-adding-jwt-token-based-authentication-to-your-single-page-nodejs-applications-c403f7cf04f4" rel="nofollow noreferrer">Medium</a>. I'm confused by one point of this guide, about using secrets, that says: </p>
  
  <blockquote>
    <p>This secret will be read by JWT library while creating and validating tokens. In production, we need to store this secret in environment variable instead of a file.</p>
  </blockquote>
  
  <p>In the guide, they placed the secret inside a config file. I wish the guide described why exactly the JWT secret should be an environment variable instead of in a config file, but it's pretty vague. So why should secrets be environment variables, and what are other best practices for using secrets? I've decided to use Passport &amp; Express Sessions for authentication instead of JWT, but I'd think it still applies to session secrets.</p>
  
  <p>My next question is how would I exactly set a secret in an environment variable? I'm not using the guide anymore, but how would somebody that is using it convert that config file into an environment variable? And lastly, what do you usually use environment variables for in a typical Node.js app?</p>