# Configuration best practices

## Read environment variables in configuration files

Call ___SINGLE_BACKTICK___env()___SINGLE_BACKTICK___ only from configuration files. After you cache the configuration, Laravel does not load the application's ___SINGLE_BACKTICK___.env___SINGLE_BACKTICK___ file, so read configuration values in application code through ___SINGLE_BACKTICK___config()___SINGLE_BACKTICK___.

Incorrect:

___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___php
$key = env('API_KEY');
___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___

Correct:

___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___php
// config/services.php
return [
    'key' => env('API_KEY'),
];

// Application code
$key = config('services.key');
___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___

## Protect production secrets

Do not commit plaintext production secrets. Laravel can encrypt an environment file so you can store the encrypted file safely. Deployment platforms can also supply secrets through their native secret stores.

Incorrect:

___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___bash
# A plaintext .env file committed to the repository
STRIPE_SECRET=<your-stripe-secret>
AWS_SECRET_ACCESS_KEY=<your-aws-secret>
___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___

Encrypted environment file:

___SINGLE_BACKTICK______SINGLE_BACKTICK______SINGLE_BACKTICK___bash