node --env-file=.env server.js
Node 20.6 and newer read the file and put the values in process.env. Pass the flag twice to layer files; later ones win:
node --env-file=.env --env-file=.env.local server.js
Since Node 22.9 there's also --env-file-if-exists=.env, which doesn't complain when the file is missing, handy in production where the variables come from the host instead.
Or load it from code with process.loadEnvFile('.env') (Node 21.7+). Either way, keep .env out of git.