for dev environment, I usually use sops as mentioned here on the thread. It removes the need for .env files and you don’t need to pass them around to your team or worry about .gitignore them.
When you load the sops secrets, they come out as envs in your terminal so you can use System.get_env/2 in your config/runtime files. I wrote about sops last year in my blog in case you want to see how I use it.
It’s possible to extend this configuration using infrastructure secrets (like KMS) but local secrets with age works well too.

You might like fnox to store secrets in dev environment. For production apps running as a systemd service, use the built-in systemd-creds mechanism.

The easiest way to do this in any application is to:

1. Install a dotenv cli [1], [2]
2. Populate your .env file
3. Run the application through the dotenv cli to apply environment variables, ex:
   dotenvx run -– mix phx.server
4. Access the environment variables as idiomatic to your application’s language