When should you use environment variables versus config files?

The twelve-factor principle is to separate config from code. Environment variables are convenient because the same artifact can run in different environments, but they are a flat string-only interface with no schema.

• Environment variables suit ports, service URLs, feature defaults and injected credentials
• Config files suit structured non-secret settings that belong in version control
• Never commit a populated .env file; commit an example with placeholder keys
• Validate required variables at startup and fail fast with a clear message
• Document precedence when defaults, files and environment overrides interact

function required(name) {
  const value = process.env[name];
  if (!value) {
    throw new Error('Missing required environment variable: ' + name);
  }
  return value;
}

const databaseUrl = required('DATABASE_URL');
const port = Number(process.env.PORT || '8080');