read secrets from env var