You can create abstractions using apps that will access the local keychain (usually password protected) and expose secrets to the local env whole running the ap

You can create abstractions using apps that will access the local keychain (usually password protected) and expose secrets to the local env whole running the app “a-la Doppler, secret hub, etc”. There is aws-vault which follows a similar pattern. Other than that, no way you can go around the fact that the token needs to be exposed at runtime… Another security layer is using temp credentials but still you need the original creds to issue the temp creds…