You can do better. If you are a developer and you are using a dedicated machine for your project development, you can remove the .env files. You should not use them at all, in this specific case. Naturally you can use it, if you develop many projects and use the same values to export different values, but is not recommended. What you should do is to export the values into Bash.
vim .bashrc
export PROJECTNAME_TOKEN="lkashjdlkajsldkajsldkajsldkjasdl"
Then, not even malicious attackers can access that data, because is not on the .env file, but in your Linux Enviroment. Only if the attacker own your machine, but in that case, your server is compromised. Even then, you should not run your code as the root user, but with a non-privileded user. In case an attacker own your machine, he will not have root access. ;)
Another cool thing you can improve when using APIs, is to setup a Reverse Proxy. You can create a "Virtual Path" that doesn't exist as a folder tree. For example: yourAwesomeDomain.com/this/is/my/secret/path/to/my/api/ . Using this path is the way to talk with your API, while the main site, folder tree can have no subfolders but only a index.html file that say "Nothing here". Or even better, you can remove that index file, so the attackers see that you didn't setup any page there. So they will quit to attack, because by Logic, there is no content there. ;)