I have a secret key called API_KEY that I want to access inside of package.json's scripts.

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=API_KEY"
   }
}

My .env file contains API_KEY:

API_KEY=abc123

How can I access the value of API_KEY inside package.json's scripts while still keeping it a secret because I need to push package.json publicly?

Currently, I do the following which works but not cross-platform:

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=$API_KEY"
   }
}

And when running start script I do it like:

API_KEY=abc123 npm start

This works thanks to Bash Programming Language but it doesn't work on Windows. I need to replace $API_KEY in start script with %API_KEY%. But I want it to be cross-platform. Is there any other way?

I have a secret key called API_KEY that I want to access inside of package.json's scripts.

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=API_KEY"
   }
}

My .env file contains API_KEY:

API_KEY=abc123

How can I access the value of API_KEY inside package.json's scripts while still keeping it a secret because I need to push package.json publicly?

Currently, I do the following which works but not cross-platform:

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=$API_KEY"
   }
}

And when running start script I do it like:

API_KEY=abc123 npm start

This works thanks to Bash Programming Language but it doesn't work on Windows. I need to replace $API_KEY in start script with %API_KEY%. But I want it to be cross-platform. Is there any other way?

• javascript
• node.js
• environment-variables
• secret-key

• Why not just simply create a directory called config with a js file named config.js and do a module export of that api key? Than copy that file and name it config.js.example that would be empty with a file exclusion in .gitignore? – GʀᴜᴍᴘʏCᴀᴛ Commented Sep 22, 2019 at 9:06
• Possible duplicate of How to set environment variables from within package.json – GʀᴜᴍᴘʏCᴀᴛ Commented Sep 22, 2019 at 9:09
• @DᴀʀᴛʜVᴀᴅᴇʀ imo it's not a duplicate as i want to keep the environment variables value private. there is an answer containing env-cmd which might've worked for my case but it can't as i want to use the variable as an argument to --api-key so can't do that according to github./toddbluhm/env-cmd-examples/issues/… – deadcoder0904 Commented Sep 22, 2019 at 14:11
• 1 "when running start script I do it like API_KEY=abc123 npm start" - why use environment variables at all when you have a cli parameter for that? Just drop the --api-key=API_KEY from the package.json - no issues with cross-platform patibility - and call it like npm start --api-key=abc123. – Bergi Commented Sep 22, 2019 at 14:33
• @Bergi I still need to remember the argument --api-key & --api-secret. So rather than that, I find my own solution to be good suggested in the question. Only thing to make it work on Windows, is to change $API_KEY to %API_KEY%. When I posted the question, I thought a simpler solution exists but unfortunately it doesn't :( – deadcoder0904 Commented Sep 23, 2019 at 5:39

4 Answers 4

The only other viable answer to this I found so far is a bit hacky:

{
   "scripts": {
      "start": "web-ext run --api-key=$(grep API_KEY .env | cut -d '=' -f2)"
   }
}

[https://stackoverflow./a/58038814/1822977]

For cross platform

1) You can use 'npm env-cmd' as a devDependencies.

Setting the environment from a file

Usage

Environment file ./.env

# This is a ment
API_KEY=abc123

Package.json

{
  "scripts": {
    "start": "env-cmd web-ext run"
  }
}

2) You can use 'npm cross-env' as a devDependencies.

Run scripts that set and use environment variables across platforms

Usage

{
  "scripts": {
    "start": "cross-env API_KEY=abc123 web-ext run"
  }
}

For Windows only

You can try something like this:

cmd /C "set API_KEY=abc123 && npm start"

As Viper_Sb says here:

/C exits the new cmd right away after running, if you produce output with the new one it will still be visible in the parent window.

You can opt to use /K in which case the new cmd window stays open at the end of the run.

Cross-Plattform: Using dotenv-cli & cross-var

Disclaimer: Only tested with Windows 11 (PowerShell 7 and CMD) so far.

Requires dotenv-cli and cross-var (or a fork like x-var)

dotenv-cli: Makes the values from .env accessible inside the scripts-section.

cross-var: Makes it usable cross-plattform with $API_KEY when between \" \" like \"$API_KEY\".

.env

API_KEY='sdf8879123sdfi'
API_ENDPOINT='https://api.example.'

packages.json

{
  "scripts": {
    "check-env": "dotenv -- cross-var echo \"$API_ENDPOINT\"",
    "start-v1": "dotenv -- cross-var YOUR-CUSTOM-START-COMMAND --api=\"$API_ENDPOINT\" --key=\"$API_KEY\""
    "start-v2": "dotenv -- cross-var \" YOUR-CUSTOM-START-COMMAND --api=$API_ENDPOINT --api-key=$API_KEY \""

 }
  "devDependencies": {
    "cross-var": "^1.1.0",
    "dotenv-cli": "^7.0.0",
  }
}

Syntax-Explanation

dotenv --: The -- belongs to dotenv-cli, and it's used as a separator. It's helpful to specify which flags belong to dotenv like dotenv -e .env.local -- [...] and which belong to the rest.

You can simply require "dotenv" lib, and access var from process.env.{SOME_KEY}