title: How does my production Heroku app know what secret key to use if I am not supposed to commit .env?
body: <p>In my local file structure, I created a file called <code>.env</code> to hold my secret key for JWT authentication. When I deploy my app to Heroku using git and then try to send the API requests using Postman, I get this message:</p>
  
  <blockquote>
    <p>Error: secretOrPrivateKey must have a value</p>
  </blockquote>
  
  <p>From other searches it appears this is because I didn't deploy my <code>.env</code> file where that info is located. However, the web also makes it clear you are not supposed to deploy that file.</p>
  
  <p>Which is why I ask, how on earth is my app supposed do encode the JWT without having the secret key in that <code>.env</code> available? </p>