Looks like there are a couple of use cases. The expansion supports several transformations that can help build values: "json" outputs the content using JSON

Looks like there are a couple of use cases. The expansion supports several transformations that can help build values: "json" outputs the content using JSON string quoting rules. "url" shows the content URL (percent) encoded. "b64" expands the variable base64 encoded Command-line arguments are visible to others (eg, through ps or /proc/<pid>/cmdline) so including a secret directly on the command-line may leak data. (For context, here's a SO message asking how to avoid that sort of leakage: https://stackoverflow.com/questions/3830823/hiding-secret-from-command-line-parameter-on-unix https://stackoverflow.com/questions/3830823/hiding-secret-fr... ) You can use different files for different configurations, rather than depend on (global) shell variables.