Twelve-factor config
Twelve-factor config means storing configuration in the environment, not in code. Learn the principle, why it keeps apps portable, and how it handles secrets.
Twelve-factor config is a principle from the Twelve-Factor App methodology that says configuration should be stored in the environment, not in code. Anything that varies between deploys, such as credentials and resource handles, belongs in environment variables. This keeps a single codebase portable across environments and prevents secrets from being committed to version control.
The principle
The Twelve-Factor App is a set of guidelines for building portable, scalable web services, and its third factor covers configuration. The core test is simple: could you open-source your codebase right now without exposing any credentials? If the answer is no, config is leaking into code. Twelve-factor config draws a strict line between code, which is the same across every deploy, and config, which differs between local, staging, and production. Database URLs, API keys, and per-environment toggles are read from environment variables at runtime. This avoids brittle patterns like grouping settings into named config files such as development.rb or production.json that multiply as environments grow.
Config and secrets in practice
In practice, twelve-factor config often starts with a .env file in local development and real environment variables in production. The principle keeps applications portable, but it does not by itself secure the values: environment variables and .env files store secrets in plaintext. As teams grow, the same config that made deploys flexible becomes a source of secret sprawl across machines and CI systems. A secrets manager complements the twelve-factor approach by keeping config in the environment while encrypting the sensitive parts. Envless follows this model, injecting variables at runtime, for example envless run -- npm start, while values stay encrypted and access is controlled by workspace roles and private products.
Related terms
Twelve-factor config FAQ
Environment variables are language-agnostic, easy to change between deploys without editing code, and never committed to version control. Storing config in the environment keeps one codebase portable across local, staging, and production, and avoids a sprawling set of per-environment config files.
No. The principle keeps config out of code and makes apps portable, but environment variables and .env files store values in plaintext. To secure secrets, combine the twelve-factor approach with a secrets manager that encrypts values and enforces access control while still injecting config at runtime.
A .env file is a practical local stand-in for real environment variables and fits the spirit of twelve-factor config, as long as it is never committed. In production, the methodology favors setting actual environment variables or pulling config from a managed source at runtime.
Ship secrets, not chaos.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.