How to Set Environment Variables for a Node.js App on Webuzo

On Webuzo you can supply environment variables to your Node.js app through PM2, an .env file loaded by your app, or the shell — keeping database passwords, API keys and config out of your code. Because you control the process, you have more options than on managed shared hosting.

Why environment variables

Hard-coding secrets and settings is risky and inflexible. Environment variables separate configuration from code, so you can change settings without editing files and avoid committing secrets — see the general guide on managing secrets in Node.js.

Option 1: A .env file

Place a .env file in your app and load it with a library like dotenv. Keep it out of version control (add it to .gitignore) and restrict its file permissions so only your user can read it.

Option 2: Through PM2

Since you run the app with PM2, you can define environment variables in a PM2 ecosystem config file and start the app from it, so PM2 injects them at launch. This keeps configuration with your process definition.

Option 3: In the shell

You can export variables in your shell before starting the app, though a .env file or PM2 config is more repeatable for a long-running service.

Reading them

const apiKey = process.env.API_KEY;

Good practices

• Restart after changes so new values load — pm2 restart myapp.
• Never commit secrets to your repository.
• Validate required variables at startup so a missing one fails clearly.

Frequently asked questions

Which method is best on Webuzo?

A PM2 ecosystem config or a git-ignored .env file are both clean and repeatable for a long-running app. Shell exports work but are easy to forget on restart. Pick one and be consistent.

My app doesn't see the new variable.

Restart the app so it reloads its environment, and confirm the variable name matches what your code reads from process.env. With PM2, restart the process after changing the config.

How do I keep the .env file secure?

Keep it out of version control and restrict its permissions so only your account can read it. Never place real secrets in a file that is committed or world-readable.