The first time Claude Code told me to "add it to your .env file," I couldn't find the file, even though it was sitting right there in my project folder, hidden by my Mac.
What is a .env file?
A .env file (say "dot env") is a small text file on your computer that holds the passwords and keys your code needs.
Each line is a name, an equals sign, and a value:
ALIEM_WP_APP_PASSWORD="abcd efgh ijkl mnop qrst uvwx"The code that uploads my courses never contains that password. Instead, the code says, in effect, "use the password named ALIEM_WP_APP_PASSWORD." When the code runs, my computer looks up that name in the .env file and plugs in the real password.
How Claude Code uses a password it never sees
This is the part that took me a while.
Claude Code writes the code and runs it. It knows the password's name. It never needs the password itself. The password lives only in my .env file, and my computer matches the two up at the moment the code runs.
My AI agent for my WordPress sites has this written into its instructions: treat the .env file as load-only. The code loads it. Claude Code doesn't open it, search it, or show it. I added that rule after Claude Code showed one of my app passwords in our chat.
What's in my .env files, and why
I have one .env file per project. Here are the names in two of them, and what each one is for. Names only, of course.
My AI agent for my WordPress sites uses these. For ALiEMU, my online course site:
ALIEMU_WP_SITE: the site's address.ALIEMU_WP_USER: my WordPress username.ALIEMU_WP_APP_PASSWORD: the app password that lets Claude Code upload courses as me.
The same three again for ALiEM, my blog site: ALIEM_WP_SITE, ALIEM_WP_USER, and ALIEM_WP_APP_PASSWORD.
Then two keys for other services. A key (some services call it a token) is a password a service gives you so your code can use it, instead of you logging in:
TALLY_API_KEY: for Tally, an online form tool.CLOUDFLARE_API_TOKEN: a read-only key for Cloudflare, so a script can pull ALiEM's weekly traffic numbers. Read-only means it can look but can't change anything.
My personal AI assistant, PAIA, has its own .env file:
ALIEM_GMAIL_APP_PASSWORD: an app password for my ALiEM Gmail, so PAIA can work with my email. Same idea as the WordPress ones, for a different account.GOOGLE_CALENDAR_ICAL_URL: a private link to my Google Calendar. It's just a web address, and it's still a secret.Google calls it the "secret address." Anyone who has it can see my calendar.Google calls it the "secret address." Anyone who has it can see my calendar.
Keeping all of these in one file per project means there's one place to look, and one place to fix if a password ever leaks.
How to edit a .env file
Fortunately, editing a .env file does not require you to open a Terminal window, which I always try to avoid if possible.
- Open your project folder in Finder.
- Press Command + Shift + . (period) to show hidden files. The .env file appears, slightly faded. Press it again to hide them.I learned this shortcut only after wondering where the file went.I learned this shortcut only after wondering where the file went.
- Right-click the .env file and choose Open With → TextEdit.
- Paste your real value between the quotation marks Claude Code left for you.
- Save and close.
Keep the quotation marks around app passwords. They have spaces in them, and the quotes keep the whole thing together.
One TextEdit catch: it likes to turn straight quotes (") into curly ones (“ ”), which breaks the file. Before you paste, go to Edit → Substitutions and turn off Smart Quotes.
Claude Code writes the placeholder. I paste the secret. The real value only ever passes through my own hands.
The code knows the name. Only the file knows the password.