Cypress is configured in cypress.config.js (baseUrl, timeouts, viewport, retries, specPattern) and reads environment-specific values via env variables accessed with Cypress.env().
baseUrl lets you use cy.visit('/path') instead of full URLs and enables Cypress to verify the app is reachable. Environment variables (set in the config's env block, via CYPRESS_* OS variables, cypress.env.json, or the CLI --env flag) hold per-environment data like API URLs, users, or secrets, read with Cypress.env('apiUrl'). Precedence matters: CLI/OS variables override file values. Other common config: defaultCommandTimeout, retries (runMode/openMode), viewportWidth/Height, and video/screenshot settings. Keep secrets out of source control by injecting them via CI environment variables.
One suite runs against dev, staging, and prod by passing --env apiUrl=https://staging.api and setting baseUrl per environment in CI, so the same specs test every environment without code changes.
How do you run the same Cypress specs against staging and production with different URLs and credentials, without changing test code?