How to Properly Use Laravel Config & .env for Scalable, Secure Apps

If you’ve been working with Laravel for a while, you’ve probably heard about config files and the mysterious .env file. At first glance, they might seem like small details. But here’s the truth: properly managing your Laravel configuration and environment variables can make or break the scalability, security, and maintainability of your app.

In this guide, I’ll walk you through how to use Laravel config and .env variables the right way, why it matters, and real-world examples you can apply to your projects immediately.

📂 Inside the config/ Directory

The config/ directory contains files like:

• app.php – General app settings
• database.php – Database connections
• mail.php – Mail service settings

Each file is a plain PHP array that’s easy to customize. For example, in config/app.php:

return [
    'name' => env('APP_NAME', 'MyLaravelApp'),
    'timezone' => 'UTC',
];

Here, APP_NAME is pulled from your .env file.

📝 Understanding .env and .env.example

• .env file → Defines environment-specific values like API keys, mail drivers, and database credentials.
• .env.example file → Acts as a template without sensitive values so others can set up the project easily.

Example .env:

APP_NAME=EcommercePro
APP_ENV=local
APP_DEBUG=true

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_DATABASE=ecommerce_db
DB_USERNAME=admin
DB_PASSWORD=secret

MAIL_MAILER=smtp
MAIL_HOST=smtp.mailtrap.io
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null

⚡ config() vs env(): What’s the Difference?

Laravel provides two functions:

• env() → Fetches values directly from .env (use only inside config files).
• config() → Fetches values from config/ files (use this in your app’s logic).

👉 Best Practice: Always use config() in controllers, services, or views.

Example:

// BAD ❌
$currency = env('APP_CURRENCY');

// GOOD ✅
$currency = config('app.currency');

💡 Practical Example

Step 1: Add variables to .env

APP_CURRENCY=USD
SUPPORT_EMAIL=support@ecommercepro.com

Step 2: Reference them in config/app.php

return [
    'name' => env('APP_NAME', 'MyLaravelApp'),
    'currency' => env('APP_CURRENCY', 'USD'),
    'support_email' => env('SUPPORT_EMAIL', 'help@myapp.com'),
];

Step 3: Access them anywhere in your app

echo config('app.currency'); 
// Output: USD

echo config('app.support_email'); 
// Output: support@ecommercepro.com

📑 Creating Custom Config Files

Let’s create a new file config/payment.php:

return [
    'gateway' => env('PAYMENT_GATEWAY', 'stripe'),
    'stripe_key' => env('STRIPE_KEY', 'your-stripe-key'),
    'paypal_client_id' => env('PAYPAL_CLIENT_ID', 'your-paypal-id'),
];

And add to .env:

PAYMENT_GATEWAY=stripe
STRIPE_KEY=sk_test_12345
PAYPAL_CLIENT_ID=paypal_test_67890

Usage in your app:

config('payment.gateway'); // stripe
config('payment.stripe_key'); // sk_test_12345

🌀 Nested Config Values & Dot Notation

You can also organize config values in nested arrays.

Example config/services.php:

return [
    'notifications' => [
        'sms' => env('SMS_PROVIDER', 'twilio'),
        'email' => env('MAIL_PROVIDER', 'mailgun'),
    ],
];

.env file:

SMS_PROVIDER=twilio
MAIL_PROVIDER=sendgrid

Access values:

config('services.notifications.sms'); // twilio
config('services.notifications.email'); // sendgrid

🚨 Common Mistakes to Avoid

• ❌ Using env() directly in controllers or services.
• ❌ Committing .env to version control.
• ❌ Hardcoding credentials in code.
• ❌ Forgetting to update .env.example when adding new variables.

✅ Best Practices

• Store environment-specific values in .env.
• Reference them in config files using env().
• Access them in your app with config().
• Use custom config files for clarity and scaling.
• Cache config for performance with php artisan config:cache.

🏁 Conclusion

Learning how to properly use Laravel’s config and .env files together is one of those small but powerful skills that separates beginner projects from production-ready applications.

By keeping sensitive and environment-specific values inside .env, referencing them in your config/ files, and then accessing them with the config() helper, you:

• Keep your application logic clean and secure 🔒
• Make your project portable across development, staging, and production 🚀
• Stay organized with custom and nested config files 📂
• Avoid common mistakes like misusing env() directly ❌

The takeaway is simple:
👉 Use .env for values, config/ for structure, and config() for access.

Follow this best practice, and your Laravel apps will be easier to maintain, more scalable, and ready for any environment.

If you found this helpful, feel free to share or drop a comment. Happy coding with Laravel! 🧱✨