6

I have a secret key called API_KEY that I want to access inside of package.json's scripts.

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=API_KEY"
   }
}

My .env file contains API_KEY:

API_KEY=abc123

How can I access the value of API_KEY inside package.json's scripts while still keeping it a secret because I need to push package.json publicly?

Currently, I do the following which works but not cross-platform:

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=$API_KEY"
   }
}

And when running start script I do it like:

API_KEY=abc123 npm start

This works thanks to Bash Programming Language but it doesn't work on Windows. I need to replace $API_KEY in start script with %API_KEY%. But I want it to be cross-platform. Is there any other way?

deadcoder0904
  • 7,232
  • 12
  • 66
  • 163
  • Why not just simply create a directory called config with a js file named config.js and do a module export of that api key? Than copy that file and name it config.js.example that would be empty with a file exclusion in .gitignore? – DᴀʀᴛʜVᴀᴅᴇʀ Sep 22 '19 at 09:06
  • Possible duplicate of [How to set environment variables from within package.json](https://stackoverflow.com/questions/25112510/how-to-set-environment-variables-from-within-package-json) – DᴀʀᴛʜVᴀᴅᴇʀ Sep 22 '19 at 09:09
  • @DᴀʀᴛʜVᴀᴅᴇʀ imo it's not a duplicate as i want to keep the environment variables value private. there is an answer containing `env-cmd` which might've worked for my case but it can't as i want to use the variable as an argument to `--api-key` so can't do that according to https://github.com/toddbluhm/env-cmd-examples/issues/3#issuecomment-526069343 – deadcoder0904 Sep 22 '19 at 14:11
  • 1
    "*when running `start` script I do it like `API_KEY=abc123 npm start`*" - why use environment variables at all when you have a cli parameter for that? Just drop the `--api-key=API_KEY` from the package.json - no issues with cross-platform compatibility - and call it like `npm start --api-key=abc123`. – Bergi Sep 22 '19 at 14:33
  • @Bergi I still need to remember the argument `--api-key` & `--api-secret`. So rather than that, I find my own solution to be good suggested in the question. Only thing to make it work on Windows, is to change `$API_KEY` to `%API_KEY%`. When I posted the question, I thought a simpler solution exists but unfortunately it doesn't :( – deadcoder0904 Sep 23 '19 at 05:39

4 Answers4

2

The only other viable answer to this I found so far is a bit hacky:

{
   "scripts": {
      "start": "web-ext run --api-key=$(grep API_KEY .env | cut -d '=' -f2)"
   }
}

[https://stackoverflow.com/a/58038814/1822977]

blub
  • 8,757
  • 4
  • 27
  • 38
1

For cross platform

1) You can use 'npm env-cmd' as a devDependencies.

Setting the environment from a file

Usage

Environment file ./.env

# This is a comment
API_KEY=abc123

Package.json

{
  "scripts": {
    "start": "env-cmd web-ext run"
  }
}

2) You can use 'npm cross-env' as a devDependencies.

Run scripts that set and use environment variables across platforms

Usage

{
  "scripts": {
    "start": "cross-env API_KEY=abc123 web-ext run"
  }
}

For Windows only

You can try something like this:

cmd /C "set API_KEY=abc123 && npm start"

As Viper_Sb says here:

/C exits the new cmd right away after running, if you produce output with the new one it will still be visible in the parent window.

You can opt to use /K in which case the new cmd window stays open at the end of the run.

elingerojo
  • 354
  • 2
  • 6
  • 1
    Can't use `env-cmd` as I want to pass it as an argument to `--api-key`. Can't use `cross-env` as I need to keep the value `abc123` private. The third one is only Windows :( – deadcoder0904 Sep 22 '19 at 14:02
  • `env-cmd` doesn't work for me as pointed on this issue → https://github.com/toddbluhm/env-cmd-examples/issues/3#issuecomment-526069343 which is exactly what i want to do – deadcoder0904 Sep 22 '19 at 14:12
0

Cross-Plattform: Using dotenv-cli & cross-var

Disclaimer: Only tested with Windows 11 (PowerShell 7 and CMD) so far.

Requires dotenv-cli and cross-var (or a fork like x-var)

dotenv-cli: Makes the values from .env accessible inside the scripts-section.

cross-var: Makes it usable cross-plattform with $API_KEY when between \" \" like \"$API_KEY\".

.env

API_KEY='sdf8879123sdfi'
API_ENDPOINT='https://api.example.com'

packages.json

{
  "scripts": {
    "check-env": "dotenv -- cross-var echo \"$API_ENDPOINT\"",
    "start-v1": "dotenv -- cross-var YOUR-CUSTOM-START-COMMAND --api=\"$API_ENDPOINT\" --key=\"$API_KEY\""
    "start-v2": "dotenv -- cross-var \" YOUR-CUSTOM-START-COMMAND --api=$API_ENDPOINT --api-key=$API_KEY \""

 }
  "devDependencies": {
    "cross-var": "^1.1.0",
    "dotenv-cli": "^7.0.0",
  }
}

Syntax-Explanation

dotenv --: The -- belongs to dotenv-cli, and it's used as a separator. It's helpful to specify which flags belong to dotenv like dotenv -e .env.local -- [...] and which belong to the rest.

Lukas-Sachse
  • 1
  • 2
-1

You can simply require "dotenv" lib, and access var from process.env.{SOME_KEY}

massam
  • 57
  • 6
  • 1
    No, `dotenv` doesn't work that way AFAICT. i need to access it in `package.json` > `scripts` & not a `*.js` file. `dotenv` needs to be loaded first and then used inside `*.js` file :) – deadcoder0904 Sep 22 '19 at 07:43