Best Practices for Laravel .env Management

When you’re developing a Laravel project seriously — whether for practice or production — managing environment-specific configurations properly is crucial. Laravel uses the .env file to manage sensitive and environment-specific settings like database credentials, API keys, and application settings. Let’s explore how you can handle multiple .env files (local, staging, production) correctly.

1. The Standard Approach: Different .env Files per Environment

It’s common to create separate environment files, such as:

• .env → for local development
• .env.staging → for your staging environment
• .env.production → for your production server

When you deploy, you copy the appropriate file to .env.

Example:

On your production server:

cp .env.production .env
php artisan config:cache

On your staging server:

cp .env.staging .env
php artisan config:cache

Important: Laravel only reads the .env file by default. It does not automatically detect .env.production or .env.staging.

2. Automating Deployment

In modern deployments, you can automate this copying step within your deployment scripts or CI/CD pipelines.

Example deployment snippet:

# After pulling the latest code
cp .env.production .env
php artisan migrate --force
php artisan config:cache
php artisan route:cache

This ensures your production server always uses the right environment variables.

3. Pro-Level Setup: Using Server Environment Variables

For even more professional setups, set environment variables directly at the server level instead of relying on .env files at all.

How?

In Nginx config:

fastcgi_param APP_ENV production;
fastcgi_param APP_KEY base64:YourProductionKey;
fastcgi_param DB_CONNECTION mysql;
fastcgi_param DB_DATABASE production_db;
fastcgi_param DB_USERNAME production_user;
fastcgi_param DB_PASSWORD strongpassword;

In Apache config:

SetEnv APP_ENV production
SetEnv APP_KEY base64:YourProductionKey
SetEnv DB_CONNECTION mysql
SetEnv DB_DATABASE production_db
SetEnv DB_USERNAME production_user
SetEnv DB_PASSWORD strongpassword

Laravel will prioritize these real server environment variables over what’s defined in .env.

4. What Happens If a Variable Isn’t Set?

Laravel will first check for server environment variables. If none exist, it falls back to .env.

• Local Development: Use .env
• Production/Staging: Prefer server environment variables or copy .env.production to .env

5. Why This Matters

Key Rules:

• Laravel must have a .env file if you aren’t setting environment variables server-side.
• Always run php artisan config:cache after updating environment variables or .env.
• Never commit .env files to Git — they should always be ignored.

Pro Tip: Even if you store .env.production and .env.staging somewhere secure, treat them like secrets. Do not store sensitive environment files publicly.

Final Thoughts

• You can absolutely maintain multiple .env files.
• You need to copy the right one to .env at deployment time.
• For a cleaner, more secure setup, consider setting environment variables directly on the server.
• Always cache your configuration after updating environment variables.

Want an example GitHub Actions deployment workflow or a Forge deploy script? Let me know and I can show you how to automate all of this perfectly! 🚀