Dotenv and env

The .env file

The .env file stores default settings for the project such as the application mode and the database path. It is committed to version control so every checkout starts with working values.

Keep only safe defaults there and never store real passwords inside it. Each line holds one name and value pair that Symfony loads at boot time.

APP_ENV=dev APP_SECRET=changeme DATABASE_URL=sqlite:////tmp/app.db

.env.local ignored

The local override file holds personal secrets and machine specific paths for one developer computer. It is ignored by version control so private values never reach the shared repository.

Copy the needed keys from the main file and change the values locally. New team members create their own copy without touching committed files.

.env.local: local overrides, never committed APP_SECRET=local-only-value

Read with %env%

Configuration files do not read environment values directly but reference them with placeholders. The placeholder is resolved at runtime from the loaded environment.

Write the variable name inside the placeholder exactly as it appears in the environment file. A missing name fails fast, which points straight to the absent setting.

parameters: app_secret: "%env(APP_SECRET)%"

Prod reads real env

Production servers provide settings through real environment values set by the hosting platform. File based defaults stay as fallback while secrets come from the platform vault.

Read a value in PHP from the server array when custom startup logic needs it. Keep the same variable names across all stages so deploys behave predictably.

$secret = $_ENV["APP_SECRET"]; echo $secret;

Next: Profiler

Article author: Arthur Isaev