Navigated to /docs/core/environment-variables

Environment variables

Load server configuration safely, expose only deliberate public values to browser code, and understand mode-specific .env files.

Choose the boundary before naming the variable

BoundaryExampleRead it from
Server onlyprocess.env.DATABASE_URLsrc/server, a server loader, action, middleware, or server plugin phase
Browser safeimport.meta.env.VITE_PUBLIC_API_ORIGINA normal source module used by browser code
Build/configurationprocess.env.TAVO_SITE_URLtavo.config.ts or server-side build tooling

Use mode-specific files deliberately

Tavo.js's server runtime reads these files from the project root. Later files override earlier files, while an environment variable already supplied by the shell or hosting platform wins over every file.

TEXT
text.env
.env.local
.env.development
.env.development.local

# A production run uses .env.production and .env.production.local instead.

Commit non-secret defaults in .env when appropriate. Keep .env.local and mode-local files out of source control. Commit an .env.example containing names and safe placeholders so new developers know what the application requires.

Read secrets behind a server-only boundary

TS
tsimport "@tavojs/core/server-only";

const databaseUrl = process.env.DATABASE_URL;

if (!databaseUrl) {
  throw new Error("DATABASE_URL is required");
}

export function getProjectsDatabaseUrl(): string {
  return databaseUrl;
}

Files under src/server and modules importing the server-only marker are framework-enforced client-build boundaries. Import them from a server loader, action, middleware, or server plugin phase. Do not statically import them into a component or universal loader.

Expose only browser-safe configuration

BASH
bashVITE_PUBLIC_API_ORIGIN=https://api.example.com
TS
tsexport const publicConfig = {
  apiOrigin: import.meta.env.VITE_PUBLIC_API_ORIGIN
};

Restart the development server after changing an environment file. Verify a server value through the route or handler that consumes it; verify a public value in the browser without printing unrelated environment data.

Look up exact public types

Follow linked API names to their canonical TypeScript declarations and package boundaries.