5

I have a secret key called API_KEY that I want to access inside of package.json's scripts.

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=API_KEY"
   }
}

My .env file contains API_KEY:

API_KEY=abc123

How can I access the value of API_KEY inside package.json's scripts while still keeping it a secret because I need to push package.json publicly?

Currently, I do the following which works but not cross-platform:

package.json

{
   "scripts": {
      "start": "web-ext run --api-key=$API_KEY"
   }
}

And when running start script I do it like:

API_KEY=abc123 npm start

This works thanks to Bash Programming Language but it doesn't work on Windows. I need to replace $API_KEY in start script with %API_KEY%. But I want it to be cross-platform. Is there any other way?

deadcoder0904
  • 5,798
  • 7
  • 43
  • 124
  • Why not just simply create a directory called config with a js file named config.js and do a module export of that api key? Than copy that file and name it config.js.example that would be empty with a file exclusion in .gitignore? – DᴀʀᴛʜVᴀᴅᴇʀ Sep 22 '19 at 09:06
  • Possible duplicate of [How to set environment variables from within package.json](https://stackoverflow.com/questions/25112510/how-to-set-environment-variables-from-within-package-json) – DᴀʀᴛʜVᴀᴅᴇʀ Sep 22 '19 at 09:09
  • @DᴀʀᴛʜVᴀᴅᴇʀ imo it's not a duplicate as i want to keep the environment variables value private. there is an answer containing `env-cmd` which might've worked for my case but it can't as i want to use the variable as an argument to `--api-key` so can't do that according to https://github.com/toddbluhm/env-cmd-examples/issues/3#issuecomment-526069343 – deadcoder0904 Sep 22 '19 at 14:11
  • 1
    "*when running `start` script I do it like `API_KEY=abc123 npm start`*" - why use environment variables at all when you have a cli parameter for that? Just drop the `--api-key=API_KEY` from the package.json - no issues with cross-platform compatibility - and call it like `npm start --api-key=abc123`. – Bergi Sep 22 '19 at 14:33
  • @Bergi I still need to remember the argument `--api-key` & `--api-secret`. So rather than that, I find my own solution to be good suggested in the question. Only thing to make it work on Windows, is to change `$API_KEY` to `%API_KEY%`. When I posted the question, I thought a simpler solution exists but unfortunately it doesn't :( – deadcoder0904 Sep 23 '19 at 05:39

3 Answers3

2

The only other viable answer to this I found so far is a bit hacky:

{
   "scripts": {
      "start": "web-ext run --api-key=$(grep API_KEY .env | cut -d '=' -f2)"
   }
}

[https://stackoverflow.com/a/58038814/1822977]

blub
  • 7,744
  • 4
  • 25
  • 36
1

For cross platform

1) You can use 'npm env-cmd' as a devDependencies.

Setting the environment from a file

Usage

Environment file ./.env

# This is a comment
API_KEY=abc123

Package.json

{
  "scripts": {
    "start": "env-cmd web-ext run"
  }
}

2) You can use 'npm cross-env' as a devDependencies.

Run scripts that set and use environment variables across platforms

Usage

{
  "scripts": {
    "start": "cross-env API_KEY=abc123 web-ext run"
  }
}

For Windows only

You can try something like this:

cmd /C "set API_KEY=abc123 && npm start"

As Viper_Sb says here:

/C exits the new cmd right away after running, if you produce output with the new one it will still be visible in the parent window.

You can opt to use /K in which case the new cmd window stays open at the end of the run.

elingerojo
  • 354
  • 2
  • 6
  • 1
    Can't use `env-cmd` as I want to pass it as an argument to `--api-key`. Can't use `cross-env` as I need to keep the value `abc123` private. The third one is only Windows :( – deadcoder0904 Sep 22 '19 at 14:02
  • `env-cmd` doesn't work for me as pointed on this issue → https://github.com/toddbluhm/env-cmd-examples/issues/3#issuecomment-526069343 which is exactly what i want to do – deadcoder0904 Sep 22 '19 at 14:12
-1

You can simply require "dotenv" lib, and access var from process.env.{SOME_KEY}

massam
  • 55
  • 6
  • 1
    No, `dotenv` doesn't work that way AFAICT. i need to access it in `package.json` > `scripts` & not a `*.js` file. `dotenv` needs to be loaded first and then used inside `*.js` file :) – deadcoder0904 Sep 22 '19 at 07:43