# How to store access token as an environment variable (no hardcoding)?

**URL:** <https://community.hubspot.com/t/how-to-store-access-token-as-an-environment-variable-no-hardcoding/88138>\
**Category:** CMS Development\
**Tags:** professional\
**Created:** [August 23, 2023, 1:52pm UTC](https://community.hubspot.com/t/how-to-store-access-token-as-an-environment-variable-no-hardcoding/88138 "2023-08-23T13:52:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ChrisSosa1337](https://avatars.discourse-cdn.com/v4/letter/c/9dc877/32.png) [@ChrisSosa1337](https://community.hubspot.com/u/ChrisSosa1337)\
**Post date:** [August 23, 2023, 1:52pm UTC](https://community.hubspot.com/t/how-to-store-access-token-as-an-environment-variable-no-hardcoding/88138/1 "2023-08-23T13:52:40Z")

</div>

I was wondering, I am new to Hubspot development, and I would like to know, how would I store my access token as an environment variable (no hardcoding). We eventually want to put this code on a live server, and for security reasons I don’t want to have a hardcoded access token in my code. All the information on the web seems to only talk about the old method of API keys.

This is my current code:

const express = require(‘express’);

const axios = require(‘axios’);

const app = express();

const hubspot = require(‘@hubspot/api-client’);

const private\_app\_token = ‘my\_token’

const hubspotClient = new hubspot.Client({“accessToken”:private\_app\_token});

const companyIdConst = window.location.href.lastIndexOf(‘/’) + 1;

app.get(‘/companies’, async (req, res) =\> {

const companyId = companyIdConst;

const properties = [“zip”];

const propertiesWithHistory = undefined;

const associations = undefined;

const archived = false;

const idProperty = undefined;

try {

const apiResponse = await hubspotClient.crm.companies.basicApi.getById(companyId, properties, propertiesWithHistory, associations, archived, idProperty);

const data = apiResponse.results;

[//res.json](https://res.json)(data);

console.log(JSON.stringify(apiResponse.properties.zip, null, 2));

} catch (e) {

e.message === ‘HTTP request failed’

? console.error(JSON.stringify(e.response, null, 2))

: console.error(e)

}

});

app.listen(3000, () =\> console.log(‘Listening on [http://localhost:3000](http://localhost:3000)’));

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [August 24, 2023, 9:56pm UTC](https://community.hubspot.com/t/how-to-store-access-token-as-an-environment-variable-no-hardcoding/88138/2 "2023-08-24T21:56:43Z")

</div>

Hey, @ChrisSosa1337 👋 Thanks for the great question. I have some best practices type suggestions. If you’ve tried these already, please let the community know, and we’ll see if the community has other ways to accomplish this goal.

- If you are using a Unix-based system (like macOS or Linux), you can set it in your `.bashrc` or `.zshrc`  
`export HUBSPOT_ACCESS_TOKEN=your_actual_token_here`
- dotenv is a pretty common package when using Node.js  
`npm install dotenv​`
- Create an .env file in your root of your project  
`HUBSPOT_ACCESS_TOKEN=your_actual_token_here​`
- You could replace your hardcoded token like this  
`const private_app_token = process.env.HUBSPOT_ACCESS_TOKEN;​`
- **Important** : Make sure to add `.env` to your `.gitignore` file to prevent accidentally pushing your access token to a public repository

One additional question, is this part of your code returning the company ID as expected?

`const companyIdConst = window.location.href.lastIndexOf('/') + 1;`

Talk soon! — Jaycee