An environment variable is a configuration value kept outside the main code. Your codebase says “read the key from QUICKBOOKS_API_KEY,” and the value lives elsewhere: an env file, a hosting dashboard, or a secrets manager. The same code runs on your laptop with test values and in production with real ones. Env vars hold more than secrets; a mode, a feature flag (a setting that turns something on or off), or a public URL all fit.
An employee handbook and the office safe show the split. The handbook says, “To open payroll, use the credential in the safe.” It never prints the password on page 12. The instruction belongs in the handbook, the secret somewhere controlled.
Why you care
Env vars explain the classic “works locally but not in production”: the code is fine, the production environment is missing a value. They matter with agents too. Paste a real API key into a prompt or source file and you may have exposed it; store it in a managed secret system and pass it in as an env var instead (cleaner, though the running process can still read it). For deployment, they’re part of the checklist: which values the app needs, which are safe to expose, and which must stay private.