output-credentials-env-vars

Use the credential: convention to resolve encrypted credentials into environment variables at worker startup. The startup resolver decrypts values from config/credentials.yml.enc and injects them into process.env, replacing credential: references with real values.

Yes, you can migrate plaintext .env secrets to encrypted credentials seamlessly. Replace plaintext values with credential: references in your environment configuration, and the startup resolver decrypts and injects them at runtime while preserving existing non-credential env vars.

The credential: convention prefixes any env var value sourced from encrypted credentials. At worker startup, the resolver decrypts the corresponding entry from config/credentials.yml.enc and replaces the credential: reference with the actual API key value in process.env.

Yes, you can use the optional _env section within config/credentials.yml.enc to document intended environment variable mappings. This provides clear traceability for which encrypted credentials map to which env vars across development, testing, and production workflows.

Wire encrypted credentials to environment variables using config/credentials.yml.enc and the credential: convention. Real secrets stay out of source, logs, and code, with deterministic startup behavior that decrypts values only at runtime.