single call for env var encryption