For the command line, do what OpenSSH does, take passwords on terminals.

For environment variables, the issue is passing them to all programs; you don’t want to put credentials in a .bashenv or similar.