olususi-oluyemi

Oluyemi is a tech enthusiast with a background in Telecommunication Engineering. He ventured into programming with a keen interest in solving day-to-day problems encountered by users. He has since directed his problem-solving skills towards building software for both the web and mobile platforms. As a full-stack software engineer with a passion for sharing knowledge, Oluyemi has published many technical articles and content on several blogs worldwide. As s tech-savvy person, his hobbies include trying out new programming languages and frameworks.

Software Engineer / Technical Content Creator

Olususi Oluyemi

Learn how to build modern and secure Full-Stack applications with React, TypeScript, and Nest.js.

Modern Full-Stack Development with Nest.js, React, TypeScript, and MongoDB: Part 1

tadej-slamic

With over a decade in the software industry, I've helped startups launch their first product, assisted FTSE100 enterprises with digital transformation, been a part of the fintech boom, and helped particle accelerators cool down. I enjoy architecting and creating scalable backends and crafting modern mobile, web, and desktop apps.

CTO at Shortcut AS

Tadej Slamic

Learn how to use Spring Boot, Java, and Auth0 to secure a feature-complete API. Learn how to use Auth0 to implement authorization in Spring Boot.

Spring Boot Authorization Tutorial: Secure an API (Java)

Learn how to use Spring and Java to build a feature-complete API. Learn how to use Spring Boot to create, read, update, delete, and validate data.

Spring Boot Tutorial: Build a CRUD API (Java)

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how to use NestJS, a Node.js framework powered by TypeScript, to build a secure API.



<details>
<summary>Are you starting from this chapter?</summary>

Clone the application repo and check out the `creating-data-models-and-service` branch:

``` bash  
git clone git@github.com:auth0-blog/wab-menu-api-nestjs.git \
nest-restaurant-api \
--branch creating-data-models-and-service
```

Make the project folder your current directory:

``` bash  
cd nest-restaurant-api
```

Then, install the project dependencies:

``` bash  
npm i
```

Finally, create a `.env` hidden file:

``` bash  
touch .env
```

Populate `.env` with this:

``` bash  
PORT=7000
```

</details>

## Define the Endpoints

For this application, you'll create endpoints to access an `items` resource to perform read, write, update, and delete operations on menu items:

``` bash  
# get all items
GET items/
# get a single item using an id parameter
GET items/:id
# create an item
POST items/
# update an item
PUT items/
# delete an item using an id parameter
DELETE items/:id
```

Only the `GET` endpoints will be public, so let's start with those.

## Create a NestJS Controller

To create an `ItemsController`, execute the following command:

``` bash  
nest generate controller items --no-spec
```

Once executed, this command creates an `items.controller.ts` file under the `src/items` directory. The CLI automatically registers `ItemsController` as a controller of `ItemsModule` for you.

``` typescript  
// src/items/items.module.ts

import { Module } from '@nestjs/common';
import { ItemsService } from './items.service';
import { ItemsController } from './items.controller';

@Module({
  providers: [ItemsService],
  controllers: [ItemsController],
})
export class ItemsModule {}
```

Your application will only recognize `controllers` registered in the metadata object that the `@Module` decorator receives as argument.

Following the architectural conventions of other frameworks, [NestJS controllers](https://docs.nestjs.com/controllers) are responsible for mapping endpoints to functionality. Controllers are created using a class and a decorator as follows:

``` typescript  
@Controller('path')
export class NameController {}
```

The `@Controller` decorator takes as argument the resource path that it will handle.

Populate `src/items/items.controller.ts` as follows to create all of your application endpoints:

``` typescript  
import {
  Body,
  Controller,
  Delete,
  Get,
  Param,
  Post,
  Put,
} from '@nestjs/common';
import { ItemsService } from './items.service';
import { Items } from '../items';
import { Item } from '../item';

@Controller('items')
export class ItemsController {
  constructor(private readonly itemsService: ItemsService) {}

  @Get()
  async findAll(): Promise<Items> {
    return this.itemsService.findAll();
  }

  @Get(':id')
  async find(@Param('id') id: number): Promise<Item> {
    return this.itemsService.find(id);
  }

  @Post()
  async create(@Body('item') item: Item): Promise<void> {
    this.itemsService.create(item);
  }

  @Put()
  async update(@Body('item') item: Item): Promise<void> {
    this.itemsService.update(item);
  }

  @Delete(':id')
  async delete(@Param('id') id: number): Promise<void> {
    this.itemsService.delete(id);
  }
}
```

Let's explore in detail what's happening within `ItemsController`.

All of your endpoints share the same resource path: `items/`. You pass the path _without_ the trailing forward slash to the `@Controller` decorator as argument.

You import the `Item` and `Items` classes to add typings to your controller handlers as needed.

To handle specific HTTP requests that use the controller's path, like `GET` or `POST`, you create class methods for each one of them. These methods are called _route handlers_ and use HTTP request method decorators, like `@Get` or `@Post`, that match the type of request they handle:

``` typescript  
  @Post()
  async create(@Body('item') item: Item): Promise<void> {
    this.itemsService.create(item);
  }
```

The function name of the route handler is not relevant to how your API is consumed by clients, but it helps you to easily identify the method for code maintenance and debugging. 

Notice that the `findAll` handler is an `async` function. Why's that?

``` typescript  
  @Get()
  async findAll(): Promise<Items> {
    return this.itemsService.findAll();
  }
```

As mentioned in the [_Asynchronicity_ document](https://docs.nestjs.com/controllers#asynchronicity), data extraction is mostly asynchronous. For this reason, NestJS supports modern `async` functions, which must return a `Promise`. As such, you can return deferred values that NestJS will be able to resolve by itself.

In order to keep `ItemsController` lightweight, you delegate the business logic of each endpoint to methods from `ItemsService`. To access this service within your controller class, you inject an instance of the `ItemsService` class into it through its class constructor. The service instance is marked `private readonly` to make this instance unchangeable and only visible inside the controller class.

``` typescript  
constructor(private readonly itemsService: ItemsService) { }
```

## Make API Requests

With the service and controller in place, you can start the API and make a request to `GET items/`:

``` bash  
# start the development server
npm run start:dev

# make a request to GET items/
curl http://localhost:7000/items/
```

If the app is working as expected, you get an object containing items data as response. The `curl` command works on both macOS and Linux terminal apps as well as on Windows PowerShell.

> Developing on Windows? Learn more about [Windows PowerShell Commands for Web Developers](https://auth0.com/blog/powershell-commands-for-web-developers/#Marking-Server-Requests).

When handling requests that have a payload, you need to extract the payload data from the `body` property of the `request` object that the route handler receives. With that goal in mind, you use the `@Body()` parameter decorator to pluck properties from the `body` property. `@Body()` receives the name of the property that you want to pluck as an argument; in this case, you want the `item` property:

``` typescript  
@Post()
create(@Body('item') item: Item) {
  this.itemsService.create(item);
}
```

The argument passed to the `@Controller()` decorator defines the route path prefix, which is a path shared by all the endpoints defined within the controller. You can then create different path branches by using _route parameters_, such as `:id`. This allows you to create two distinct `GET` endpoints within the same controller:

``` bash  
GET items/
GET items/:id
```

You then pass the route parameter, `:id`, as an argument to the HTTP request decorators `@Get()`, `@Put()`, and `@Delete()` to define dynamic paths. Consequently, this route parameter lets you update, delete, and retrieve a single record.

Using the `@Param()` decorator, you can pluck properties from the `params` property of the `request` object and access the value of `id`:

``` typescript  
@Get(':id')
async find(@Param('id') id: number): Promise<Item> {
  return this.itemsService.find(id);
}
```

> `@Params()` and `@Body()` are both decorators that extract data from the `request` object.

Test the `POST items/` endpoint by executing the following command:

``` bash  
curl -X POST -H 'Content-Type: application/json' -d '{
  "item": {
    "name": "Salad",
    "price": 4.99,
    "description": "Fresh",
    "image": "https://cdn.auth0.com/blog/whatabyte/salad-sm.png"
  }
}' http://localhost:7000/items -i
```

> The `-i` flag includes protocol headers in the output.

You should get `HTTP/1.1 201 Created` as response.

Verify that an item named "Salad" has been added to the store:

``` bash  
curl http://localhost:7000/items -i
```

## Enable Data Validation in NestJS

As explained before, using classes to create custom types is recommended since they are persisted as JavaScript entities after TypeScript transpilation. During development, TypeScript's type system will help you catch errors and debug your code. However, during production, your API will face unpredictable request payloads. You can mitigate this point of failure by validating the data it receives as payload.

To validate incoming requests, you can add validators to your `Item` class properties and execute them by using the built-in NestJS validation pipe.

As it is, the application won't return an error status if you `POST` invalid data. For example, the following request should return a [`400 Bad Request`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400) response status; but instead, it returns a [`201 Created`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/201) response status:

``` bash  
curl -X POST -H 'Content-Type: application/json' -d '{
  "item": {
    "name": 1.99,
    "price": "Salad",
    "description": "Fresh",
    "image": "https://cdn.auth0.com/blog/whatabyte/salad-sm.png"
  }
}' http://localhost:7000/items -i
```

_Output_:

``` bash  
HTTP/1.1 201 Created
X-Powered-By: Express
Date: Fri, 20 Sep 2019 23:48:46 GMT
Connection: keep-alive
Content-Length: 0
```

To solve this problem, you'll set up your app to automatically validate all incoming requests using the built-in `ValidatorPipe`. In NestJS, a pipe is a class used to transform input data to a desired output or to validate input data.

To enable auto-validation, install the following NPM packages that are leveraged by `ValidationPipe`:

``` bash  
npm install class-validator class-transformer
```

[`class-validator`](https://github.com/typestack/class-validator) makes validation easy by using TypeScript decorators. [`class-transformer`](https://github.com/typestack/class-transformer) offers proper decorator-based transformation, serialization, and deserialization of plain JavaScript objects to class constructors.

Once that's installed, update `src/main.ts` as follows:

``` typescript  
// src/main.ts

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as dotenv from 'dotenv';
import { ValidationPipe } from '@nestjs/common';

dotenv.config();

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.useGlobalPipes(new ValidationPipe());
  await app.listen(process.env.PORT);
}
bootstrap();
```

Next, you need to add validation decorators to your `Item` class. Update `src/item.ts` like so:

``` typescript  
// src/item.ts

import { IsString, IsNumber, IsOptional } from 'class-validator';

export class Item {
  @IsNumber() @IsOptional() readonly id: number;
  @IsString() readonly name: string;
  @IsNumber() readonly price: number;
  @IsString() readonly description: string;
  @IsString() readonly image: string;
}
```

In essence, since you expect the payload to your endpoints to have the same structure of an `Item` object, the `Item` class is doubling as a type class and [a data transfer object (DTO) class](https://en.wikipedia.org/wiki/Data_transfer_object). As requirements change, you may need to create a separate class to define a data transfer object for a payload that includes more data than what the `Item` class provides. Increasing the data present in the payload is done to reduce the number of method calls needed for your application to fulfill a request.

The `id` property is marked as optional since the `POST items/` endpoint doesn't require an `id` as a route parameter or a payload property. Remember that the `id` of a new `Item` is created automatically by the `create` method of `ItemsService`.

Using this pipe, if the data is invalid, you throw an exception and return an error message to the client.

To test this, issue the following invalid `POST` request:

``` bash  
curl -X POST -H 'Content-Type: application/json' -d '{
  "item": {
    "name": 1.99,
    "price": "Salad",
    "description": "Fresh",
    "image": "https://cdn.auth0.com/blog/whatabyte/salad-sm.png"
  }
}' http://localhost:7000/items -i
```

This time, you do get a `400 Bad Request` response. The `message` property of the response object also reveals the payload type errors:

``` json  
{
  "statusCode": 400,
  "error": "Bad Request",
  "message": [
    {
      "target": {},
      "property": "name",
      "children": [],
      "constraints": {
        "isString": "name must be a string"
      }
    },
    {
      "target": {},
      "property": "price",
      "children": [],
      "constraints": {
        "isNumber": "price must be a number"
      }
    }
  ]
}
```

You can disable detailed validation error messages by passing an options object to the constructor of the `ValidationPipe` pipe if you need to:

``` typescript  
// Extract from src/main.ts

app.useGlobalPipes(
  new ValidationPipe({
    disableErrorMessages: true,
  }),
);
```

With error messages disabled, the response to an invalid payload looks like this:

``` bash  
{"statusCode":400,"error":"Bad Request"}
```

<include src="tutorial/NextButton" nextPart="developing-a-secure-api-with-nestjs-adding-authorization/" completedMessage="I've created endpoints with validation for my NestJS app"/>

<include src="tutorial/IssueButton" communityTopic="developing-a-secure-api-with-nestjs/33026"/>


Developing a Secure API with NestJS: Creating Endpoints



<details>
<summary>Are you starting from this chapter?</summary>

Clone the application repo and check out the `getting-started` branch:

``` bash  
git clone git@github.com:auth0-blog/wab-menu-api-nestjs.git \
nest-restaurant-api \
--branch getting-started
```

Make the project folder your current directory:

``` bash  
cd nest-restaurant-api
```

Then, install the project dependencies:

``` bash  
npm i
```

Finally, create a `.env` hidden file:

``` bash  
touch .env
```

Populate `.env` with this:

``` bash  
PORT=7000
```

</details>

## Organize NestJS Apps Using Modules

A project of large size is easier to maintain and grow when its architecture is predictable and well-organized instead of being a spaghetti-like mess. NestJS uses modules to help you organize your application logically and to establish clear feature boundaries.

![NestJS takes you from messy code to organized code](https://images.ctfassets.net/23aumh6u8s0i/7fZuSQuPAWZY5gt3hjFMMQ/7ca680157e8314b68a423751c8ae4b22/nest-js-modules)

Each application has at least one module, the **root module**, and any number of **feature modules** that encapsulate components related to a specific application feature. NestJS uses the root module as a data structure to track and resolve the relationships between all your application components. 

This application needs **three modules**: the **root module**, `AppModule`, and **two feature modules**: `ItemsModule` to encapsulate logic related to the `items` resource and `AuthModule` to handle anything related to API authorization.

Start by creating an `ItemsModule` using the NestJS CLI, which was installed as one of your `devDependencies` when you scaffolded your NestJS project:  

``` bash  
nest generate module items
```

Under the `src` directory, the CLI creates a new `items` directory to host your module files, which includes `items.module.ts` to define the `ItemsModule`. As you can see, a module is a class annotated with a `@Module()` decorator, which provides metadata that NestJS uses to organize the application structure.

Additionally, as you create new feature elements (such as classes, controllers, and services), the NestJS CLI updates the dependencies of your modules automatically. Open `src/app.module.ts` and notice how `AppModule` lists `ItemsModule` as an element of its `imports` array:

``` typescript  
// src/app.module.ts

import { Module } from '@nestjs/common';
import { ItemsModule } from './items/items.module';

@Module({
  imports: [ItemsModule],
  controllers: [],
  providers: [],
})
export class AppModule {}
```

<include src="TweetQuote" quoteText="As an architecture framework, NestJS takes the guesswork out of project structure and lets you focus on what matters the most: building robust applications"/>

## Create Data Models with TypeScript

Before creating any controllers and services, define the structure of the data you want to manage. A menu item has the following properties:

- `id`: (number) Unique identifier for the item record
- `name`: (string) Name of the item
- `price`: (number) Price of the item in dollars
- `description`: (string) Description of the item
- `image`: (string) URL pointing to the item's image

![WHATBYTE Dashboard full menu item](https://images.ctfassets.net/23aumh6u8s0i/wkMDo6PoCvR0u3QPD22BX/88843cd23660418920811bfdfc0aa08c/whatbyte-dashboard-full-menu-item)

With TypeScript, you can use either classes or interfaces to define and enforce the structure of objects during development. NestJS recommends using classes as these are preserved as real entities in the compiled JavaScript. Classes can also use decorators on its member variables to enhance them, which is quite helpful for data validation.

Using the CLI generate an `Item` class:

``` bash  
nest generate class item --no-spec
```

NestJS creates an `item.ts` file under the `src` directory for you. Open this file and populate it like so:

``` typescript  
// src/item.ts

export class Item {
  readonly id: number;
  readonly name: string;
  readonly price: number;
  readonly description: string;
  readonly image: string;
}
```

It would be best to put these objects of type `Item` in a key-value store with the `id` property serving as the key and the `Item` object as the value.

Using the CLI generate an `Items` class:

``` bash  
nest generate class items --no-spec
```

Update the newly created `src/items.ts` file as follows:

``` typescript  
// src/items.ts

import { Item } from './item';

export class Items {
    [key: number]: Item;
}
```

As you'll use these class definitions to type the methods of controllers and services that you'll create in the next sections, it's fine for these files to live under the `src` directory.

## Create a NestJS Service

Initially, you'll use an in-memory store to hold application data. Eventually, you'd want to persist those records in a [MongoDB](https://auth0.com/blog/auth0-tutorials-using-mongodb-atlas-as-a-custom-database/) or [PostgreSQL](https://auth0.com/blog/how-we-store-data-in-the-cloud-at-auth0/#PostgreSQL) store &mdash; or any other database. To migrate stores easily, you can use a pattern common to MVC architectures: lightweight controllers that delegate business logic to services. 

As such, you'll create a service to encapsulate all the business logic related to read and write operations on the menu items store. In turn, this service will expose an interface for your controllers to perform these data operations. You'll end up with a modular and reusable service that you can eventually modify to use different stores without changing the code of any of its consumers.

Use the NestJS CLI to create an `ItemsService` as follows:

``` bash  
nest generate service items --no-spec
```

> The `--no-spec` flag prevents the generation of files related to testing.

NestJS creates `items.service.ts` under the `src/items` directory. The newly defined `ItemsService` is also automatically registered as a provider of `ItemsModule`.

``` typescript  
// src/items/items.module.ts

import { Module } from '@nestjs/common';
import { ItemsService } from './items.service';

@Module({
  providers: [ItemsService],
})
export class ItemsModule {}
```

`ItemsService` will define an object to hold your store records along with methods to perform data operations on the store.

Update `src/items/items.service.ts` with the following code:

``` typescript  
// src/items/items.service.ts

import { Injectable } from '@nestjs/common';
import { Item } from '../item';
import { Items } from '../items';

@Injectable()
export class ItemsService {
  private readonly items: Items = {
    1: {
      id: 1,
      name: 'Burger',
      price: 5.99,
      description: 'Tasty',
      image: 'https://cdn.auth0.com/blog/whatabyte/burger-sm.png',
    },
    2: {
      id: 2,
      name: 'Pizza',
      price: 2.99,
      description: 'Cheesy',
      image: 'https://cdn.auth0.com/blog/whatabyte/pizza-sm.png',
    },
    3: {
      id: 3,
      name: 'Tea',
      price: 1.99,
      description: 'Informative',
      image: 'https://cdn.auth0.com/blog/whatabyte/tea-sm.png',
    },
  };

  findAll(): Items {
    return this.items;
  }

  create(newItem: Item): void {
    const id = new Date().valueOf();
    this.items[id] = {
      ...newItem,
      id,
    };
  }

  find(id: number): Item {
    const record: Item = this.items[id];

    if (record) {
      return record;
    }

    throw new Error('No record found');
  }

  update(updatedItem: Item): void {
    if (this.items[updatedItem.id]) {
      this.items[updatedItem.id] = updatedItem;
      return;
    }

    throw new Error('No record found to update');
  }

  delete(id: number):void {
    const record: Item = this.items[id];

    if (record) {
      delete this.items[id];
      return;
    }

    throw new Error('No record found to delete');
  }
}
```

Notice that the `create` method creates a unique `id` property automatically for you  when a new `Item` object is created using the [JavaScript Date API](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date):

``` typescript  
const id = new Date().valueOf();
```

This `id` value is based on the number of milliseconds between `1 January 1970 00:00:00 UTC` and the current time.

<include src="tutorial/NextButton" nextPart="developing-a-secure-api-with-nestjs-creating-endpoints/" completedMessage="I've created my NestJS data models and a data service"/>

<include src="tutorial/IssueButton" communityTopic="developing-a-secure-api-with-nestjs/33026"/>


Developing a Secure API with NestJS: Creating Data Models and Services



<div class="alert alert-info alert-icon">
<i class="icon-budicon-500"></i>
<strong>
We tested this tutorial using NestJS <code>v7.0.0</code>, Node.js <code>v10.16.3</code>, and npm <code>v6.9.0</code>.
</strong>
</div>

NestJS is known as an architecture framework for Node.js, but what is an "architecture framework"?  Is this yet another buzzword? Nope! It's legit.

NestJS may feel like the [Laravel](https://auth0.com/blog/build-a-laravel-6-app-with-authentication/) or [Rails](https://auth0.com/blog/ruby-on-rails-killer-workflow-with-docker-part-1/) of the Node.js world as it favors convention over configuration. It offers you _opinionated_ guidelines and code conventions. So, instead of worrying about naming or organizing files and folders, you can focus on building features for your product.

On its mission to remove the guesswork out of API development, NestJS offers first-class support for [TypeScript](https://auth0.com/blog/typescript-practical-introduction/) to add static type-checking to your projects. Your API code becomes self-documented: you'll know if a method expects a `string`, a ` number`, a `Cat`, or a [`TwitterHotTake`](https://twitter.com/auth0/status/1123248195369353218).

Today, you'll learn how to build a secure API with [NestJS](https://docs.nestjs.com/) and create your _own opinion_ on the framework.

## What You Will Build

Your goal is to create and secure a feature-complete API, which lets clients perform data operations on a mock restaurant menu. To test, consume, and even try to hack your API, you'll use a demo client called ["WHATABYTE Dashboard"](https://dashboard-v1.whatabyte.app/).

![WHATBYTE Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4lvQzkec18pvBbWjwGP87q/f4ce15742f30695af44a1811c7a4ec7d/whatabyte-dashboard)

![WHATBYTE Dashboard menu item](https://images.ctfassets.net/23aumh6u8s0i/8x6EQECtV02vPAebNC1XQ/645f7768ccb740dab396d77775f84038/whatabyte-dashboard-menu-item)

> This dashboard is inspired by the [sleek web player from Spotify](https://open.spotify.com/search).

We tested this tutorial using Node.js `v10.16.3` and NPM `v6.9.0`. If you need to install any of them, follow the [instructions provided by the Node.js Foundation for your operating system](https://nodejs.org/en/download/).

For **simplicity**, you'll store data in-memory and not in an external database.

For **security**, you'll limit API access by following these business rules:

- Anyone can read data.

- Only users with a `menu-admin` role are authorized to write data: create, update, or delete menu items.

## Get Started with NestJS

NestJS offers a powerful CLI tool to build your application. To generate a new project, use `npx` to run the NestJS CLI without installing it globally in your system:

``` bash  
npx @nestjs/cli new nest-restaurant-api
```

> The `npx` command is available with `npm v5.2.0` and higher.

The CLI asks you to choose a package manager, `npm` or `yarn`, and proceeds to install project dependencies using your selection. To follow this tutorial, choose `npm`.

![Using the NestJS CLI to scaffold a new project](https://images.ctfassets.net/23aumh6u8s0i/gT39eDyAeWwkFqmoO3IA7/b9821bf48f0b066b2b161b40e3fef23b/using-the-nestjs-cli-to-scaffold-a-new-project)

Once the installation is complete, you get a directory called `nest-restaurant-api`. Navigate to this directory:

``` bash  
# move into the project directory
cd nest-restaurant-api
```

## Clean Up the NestJS Starter

For simplicity, you won't be writing any tests in this tutorial. However, it would be best if you wrote robust tests for any production-ready application. As such, delete the `test` directory and the `src/app.controller.spec.ts` file from your project:

``` bash  
rm -rf test/
rm src/app.controller.spec.ts
```

> Refer to the [NestJS Testing documentation](https://docs.nestjs.com/fundamentals/testing) for details on how to perform automated tests.

After that, delete the files defining `AppController` and `AppService`:

``` bash  
rm src/app.controller.ts src/app.service.ts
```

Deleting these files breaks `AppModule` as it depends on `AppController` and `AppService`. To fix that, open the project in your preferred IDE and update `src/app.module.ts` as follows:

``` typescript  
// src/app.module.ts

import { Module } from '@nestjs/common';

@Module({
  imports: [],
  controllers: [],
  providers: [],
})
export class AppModule {}
```

## Use Environmental Variables

`src/main.ts` is the entry point of your application. However, this file uses a hard-coded port number to listen for incoming requests, `3000`, making your application less adaptable to different development and production environments.

To fix that, you can store environmental variables locally in a `.env` file and use a package like [`dotenv`](https://www.npmjs.com/package/dotenv) to load them into the global variable `process.env`.

To start, install `dotenv` in your project:

``` bash  
npm i dotenv
```

Then, create this hidden file under the root project directory:

``` bash  
touch .env
```

Open `.env` and populate it with the following data:

``` bash  
PORT=7000
``` 

To attach data from `.env` into `process.env`,  you need to call the `dotenv.config()` method at the top of each module that needs that data. As such, update `src/main.ts` to replace the hard-coded port number with `process.env.PORT` as follows:

``` typescript  
// src/main.ts

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as dotenv from 'dotenv';

dotenv.config();

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  await app.listen(process.env.PORT);
}
bootstrap();
```

Now when your application runs, it listens for requests on whatever the value of `process.env.PORT` may be &mdash; `7000` in this case.

> ⚠️ Caution: `.env` may eventually contain sensitive information, such as API keys or secrets. Add it to `.gitignore` before committing code to version control.

<include src="tutorial/NextButton" nextPart="developing-a-secure-api-with-nestjs-models-data-service/" completedMessage="I am ready to start building my NestJS app"/>

<include src="tutorial/IssueButton" communityTopic="developing-a-secure-api-with-nestjs/33026"/>

<include src="TweetQuote" quoteText="@nestframework is an architecture framework for @nodejs. Learn how to create scalable and maintainable server-side apps with it."/>


Developing a Secure API with NestJS: Getting Started

Developing a Secure API with NestJS: Managing Identity

Developing a Secure API with NestJS: Managing Roles

Learn how to build modern and secured Full-Stack applications with React, TypeScript, and Nest.js.

Modern Full-Stack Development with Nest.js, React, TypeScript, and MongoDB: Part 2

ana-ribeiro

Guest Author

Ana Ribeiro

This series shows how to create a simple, full-stack web application with Angular, TypeScript, and Nest.js. Part 1: Developing the backend API with Nest.js.

Full-Stack TypeScript Apps - Part 1: Developing Backend APIs with Nest.js

This series shows how to create a simple, full-stack web application with Angular, TypeScript, and Nest.js. Part 2: Developing frontend Angular apps.

Full-Stack TypeScript Apps - Part 2: Developing Frontend Angular Apps

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Let's learn about Nest.js, the new framework that takes advantage of TypeScript to create reliable and well structured Express applications.

"nest"