Environment variables for secrets in Django - Step-by-Step Execution

Concept Flow - Environment variables for secrets

Start Django app

↓

Read .env file or OS env

↓

Load secrets into environment variables

↓

Django settings.py reads env variables

↓

Use secrets in app securely

↓

App runs without secrets in code

Django app starts, reads environment variables from .env or OS, loads secrets into settings, then uses them securely without hardcoding.

Execution Sample

Django

import os
from dotenv import load_dotenv

load_dotenv()
SECRET_KEY = os.getenv('SECRET_KEY')

Load environment variables from .env file and assign SECRET_KEY from environment to Django settings.

Execution Table

Step	Action	Environment Variable Read	Variable Value	Effect
1	Start app	None	None	App starts, no env read yet
2	Call load_dotenv()	.env file read	SECRET_KEY=abc123	Env vars loaded into OS environment
3	Read SECRET_KEY	SECRET_KEY	abc123	SECRET_KEY variable set in settings
4	Use SECRET_KEY in app	SECRET_KEY	abc123	App uses secret without hardcoding
5	End	N/A	N/A	App runs securely with secrets from env

💡 All secrets loaded from environment variables, no secrets in code.

Variable Tracker

Variable	Start	After load_dotenv()	After os.getenv() call	Final
SECRET_KEY	None	abc123	abc123	abc123

Key Moments - 2 Insights

Why don't we hardcode the SECRET_KEY directly in settings.py?

Hardcoding secrets risks exposing them in code repositories. Using environment variables keeps secrets outside code, as shown in execution_table step 3.

What happens if the .env file is missing or SECRET_KEY is not set?

os.getenv('SECRET_KEY') returns None, so SECRET_KEY will be None, which can cause app errors. See execution_table step 3 where value would be None.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of SECRET_KEY after load_dotenv() is called?

A "abc123"

B None

C "secret"

D Empty string

💡 Hint

Check execution_table row 2 and variable_tracker column 'After load_dotenv()'

At which step does the Django app read the SECRET_KEY from environment variables?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at execution_table where SECRET_KEY is assigned from os.getenv

If the .env file is missing, what will SECRET_KEY be after os.getenv('SECRET_KEY')?

A Empty string

B "abc123"

C None

D Error thrown

💡 Hint

os.getenv returns None if variable not found, see key_moments explanation

Concept Snapshot

Use environment variables to store secrets like SECRET_KEY.
Load them with load_dotenv() or from OS environment.
Access with os.getenv('VAR_NAME') in settings.py.
Avoid hardcoding secrets in code for security.
If missing, os.getenv returns None.
Keep .env file out of version control.

Full Transcript

This visual trace shows how a Django app loads secrets securely using environment variables. The app starts, then calls load_dotenv() to read a .env file. This loads secrets like SECRET_KEY into the environment. Then settings.py reads SECRET_KEY using os.getenv. The secret is stored in a variable without hardcoding it in code. The app uses this secret securely. If the .env file or variable is missing, os.getenv returns None, which can cause errors. This method keeps secrets out of code repositories and improves security.

Practice

1. Why is it recommended to use environment variables for secrets in a Django project?

easy

A. To keep sensitive information out of the code and version control

B. To make the code run faster

C. To avoid writing settings.py file

D. To automatically generate secret keys

Solution

1. Step 1: Understand the purpose of environment variables

   Environment variables store sensitive data outside the code, so secrets are not exposed in files or repositories.

2. Step 2: Recognize the security benefit

   Keeping secrets out of code prevents accidental leaks when sharing or publishing code.

3. Final Answer:

   To keep sensitive information out of the code and version control -> Option A

4. Quick Check:

   Secrets outside code = safer projects [OK]

Hint: Secrets belong outside code, use env vars [OK]

Common Mistakes:

• Thinking env vars speed up code
• Believing env vars replace settings.py
• Assuming env vars auto-generate secrets

2. Which of the following is the correct way to read an environment variable named DJANGO_SECRET_KEY in Django's settings.py?

easy

A. secret_key = os.getenv('DJANGO_SECRET_KEY')

B. secret_key = os.environ['DJANGO_SECRET_KEY']()

C. secret_key = getenv.os('DJANGO_SECRET_KEY')

D. secret_key = os.get('DJANGO_SECRET_KEY')

Solution

1. Step 1: Recall correct syntax for environment variable access

   In Python, os.getenv('VAR_NAME') safely reads environment variables.

2. Step 2: Check each option for syntax correctness

   secret_key = os.getenv('DJANGO_SECRET_KEY') uses correct syntax. secret_key = os.environ['DJANGO_SECRET_KEY']() wrongly calls os.environ as a function. secret_key = getenv.os('DJANGO_SECRET_KEY') reverses function and module. secret_key = os.get('DJANGO_SECRET_KEY') uses a non-existent method.

3. Final Answer:

   secret_key = os.getenv('DJANGO_SECRET_KEY') -> Option A

4. Quick Check:

   Use os.getenv('VAR') to read env vars [OK]

Hint: Use os.getenv('VAR_NAME') to read env vars [OK]

Common Mistakes:

• Calling os.environ like a function
• Swapping function and module names
• Using non-existent os.get method

3. Given this code snippet in settings.py:

import os
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'defaultkey')
print(SECRET_KEY)

What will be printed if the environment variable DJANGO_SECRET_KEY is not set?

medium

A. An empty string will be printed

B. An error will occur because the variable is missing

C. None will be printed

D. The string 'defaultkey' will be printed

Solution

1. Step 1: Understand os.getenv default parameter

   If the environment variable is missing, os.getenv returns the default value provided as the second argument.

2. Step 2: Apply to given code

   Since DJANGO_SECRET_KEY is not set, os.getenv returns 'defaultkey', which is printed.

3. Final Answer:

   The string 'defaultkey' will be printed -> Option D

4. Quick Check:

   Missing env var returns default value [OK]

Hint: os.getenv returns default if env var missing [OK]

Common Mistakes:

• Expecting error if env var missing
• Thinking None is returned without default
• Assuming empty string is returned

4. You wrote this in settings.py:

import os
SECRET_KEY = os.getenv(DJANGO_SECRET_KEY)

But when running the server, you get a NameError. What is the problem?

medium

A. SECRET_KEY must be set manually, not from env vars

B. DJANGO_SECRET_KEY should be a string in quotes

C. os.getenv cannot be used in settings.py

D. You forgot to import dotenv

Solution

1. Step 1: Identify the cause of NameError

   NameError means the name DJANGO_SECRET_KEY is not defined as a variable in the code.

2. Step 2: Correct usage of os.getenv

   Environment variable names must be passed as strings, so it should be os.getenv('DJANGO_SECRET_KEY').

3. Final Answer:

   DJANGO_SECRET_KEY should be a string in quotes -> Option B

4. Quick Check:

   Env var names need quotes in os.getenv [OK]

Hint: Put env var names in quotes for os.getenv [OK]

Common Mistakes:

• Passing env var name without quotes
• Thinking os.getenv is disallowed in settings.py
• Assuming dotenv import is mandatory

5. You want to securely manage different secret keys for development and production in Django using environment variables. Which approach is best?

hard

A. Hardcode the production secret key in settings.py and use a dummy key for development

B. Store all secrets in a JSON file inside the project and read it in settings.py

C. Set DJANGO_SECRET_KEY differently in each environment and read it with os.getenv('DJANGO_SECRET_KEY') in settings.py

D. Use the same secret key for all environments to avoid confusion

Solution

1. Step 1: Understand environment-specific secrets

   Each environment (development, production) should have its own secret key to keep them isolated and secure.

2. Step 2: Use environment variables for flexibility

   Setting DJANGO_SECRET_KEY differently in each environment and reading it via os.getenv allows safe, flexible secret management without code changes.

3. Final Answer:

   Set DJANGO_SECRET_KEY differently in each environment and read it with os.getenv('DJANGO_SECRET_KEY') in settings.py -> Option C

4. Quick Check:

   Env vars per environment keep secrets safe and flexible [OK]

Hint: Use env vars per environment for secrets [OK]

Common Mistakes:

• Hardcoding secrets in code
• Sharing same secret across environments
• Storing secrets in project files