How to create a fullstack application using Django and Python Part 4

Wednesday, August 28, 2024 at 5:41 PM | 3 min read

Last modified on Thursday, July 16, 2026 at 12:34 PM

#macOS, #environment variables, #.env, #fullstack development, #git, #gitignore, #python3, #django, #python-dotenv, #security, #series

Keys hanging from a keychain

Photo by Silas Köhler on unsplash.com

Table of Contents

Update (July 2026): This walkthrough was written against Django 5.1, which reached full end-of-life in December 2025 and is no longer receiving security patches. Run python -m django --version to check which version you have.

I wrote this series as a live process, so sometimes it might seem confusing, but it all works out in the end.

Why this section?

One thing that many fail to mention in Django tutorials, development courses, or just in general, is the importance of safeguarding sensitive information that a site or application depends on. What do I mean by that? Well, most developers use the Git version control system to track changes in the development of their applications, and that includes pushing those changes to potentially public remote repositories on Git hosting services such as GitHub.

Out of the box, Django does include one piece of sensitive information that is located in the Django project's settings.py file. And that is the SECRET_KEY. There is even a comment above the variable that states the following:

# SECURITY WARNING: keep the secret key used in production secret!

Very true, but it should be kept secret period! The minute after I have created a Django project for a Django site, the settings.py file is created. That means I have to find a way of safeguarding the value of the SECRET_KEY variable. That's where the python-dotenv package comes in.

Adding a .gitignore file to the root directory of the Django site

After I run the git init command to initialize a local Git repository inside the root directory (/django-boards) of my Django site, I immediately create a file called .gitignore inside the same root directory, and add the following content:

*.log
*.pot
*.pyc
# I actually added this later once this was created
__pycache__
# I actually added this later once this was created
django_boards/__pycache__/
# I actually added this later once this was created
django_boards/boards/__pycache__/
db.sqlite3
# relevant to this project security
.env
# The venv directory should be .gitignored
venv/
# The .venv directory should be .gitignored
.venv
env/
ENV/
env.bak/
venv.bak/
# the .vscode directory, if you have one, should be ignored
.vscode/

Making sure the virtual environment is (still) activated

Next, I make sure that I have activated the virtual environment from inside the directory where the venv folder resides with the following command:

source venv/bin/activate

I know that I have successfully activated my virtual environment if my Terminal command prompt looks something like the following:

(venv)  mariacam@Marias-MBP  ~/Python-Development/django-boards   main ●

Installing python-dotenv

I run the following command to install python-dotenv from the same directory:

pip3 install python-dotenv

Importing dotenv into settings.py and configuring it

In order for Django to persistently recognize the python-dotenv package, I first have to create a .env file at the root of the Django Boards directory, which will also be the root of the application's Git repository, when I initialize it. I have to import python-dotenv into settings.py, load it, create a path to the .env file where the SECRET_KEY variable resides, and then replace the actual value of the SECRET_KEY with the SECRET_KEY variable from the .env file.

Below is how I import dotenv (that is the name of the module), take the environment variable from .env, create a path to it, and then load it into settings.py:

import os
from dotenv import load_dotenv
load_dotenv() # take environment variables from .env
dotenv_path = os.path.join(os.path.dirname(__file__), '.env')
load_dotenv(dotenv_path)

Then I replace the actual value of SECRET_KEY with the following:

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = str(os.getenv('SECRET_KEY'))

The str() method transforms the value of the 'SECRET_KEY' variable to a string. If, however, you have not created a .env file yet, str(os.getenv('SECRET_KEY')) will set the key to the string "None" if the env var isn't found. So make sure to create the .env file immediately before importing dotenv into settings.py and configuring it.

Inside of the .env file, I add something like the following:

SECRET_KEY=valueoftheSECRET_KEYvariableinsidesettings.py

There should be no space between the = sign and the value of SECRET_KEY, and no quotes added.

Now I am ready to initialize a local Git repository inside my django-boards directory, commit my changes, and push them to my remote Git repository on GitHub without fear of exposing sensitive information there. It is safely stored solely on my local machine inside an ignored .env file.

Conclusion

In this section, I discuss how to install the python-dotenv package and why it is crucial to do so as to safeguard sensitive information the Django application depends on.