How to hide environment variables in spec yaml file

I am using a spec file beneath to deploy my app. There are a few environment variables such as database password and s3 access keys. I have no problem with the database credentials as they can be set dynamically in the same file from the db service. However, I cannot find a good way to set the s3 credentials. I cannot simply put the access key and secret access key in the file as I need to commit it to our git repo. So at this stage I have to deploy using this file once and go to the project page and manually set the s3 credentials myself. Is there a more convenient way? Can I set the environment variable with doctl apps create --spec spec.yaml command? Thanks

#! spec.yaml

name: my_app
region: sgp1
services:
  - name: backend
    dockerfile_path: Dockerfile
    source_dir: .
    health_check:
      http_path: /health_check
    http_port: 3003
    instance_count: 1
    instance_size_slug: basic-xxs
    routes:
      - path: /
    github:
      branch: master
      deploy_on_push: true
      repo: my_repo
    envs:
      - key: APP_DATABASE__USERNAME
        scope: RUN_TIME
        value: ${db.USERNAME}
      - key: APP_DATABASE__PASSWORD
        scope: RUN_TIME
        value: ${db.PASSWORD}
      - key: APP_DATABASE__HOST
        scope: RUN_TIME
        value: ${db.HOSTNAME}
      - key: APP_DATABASE__PORT
        scope: RUN_TIME
        value: ${db.PORT}
      - key: APP_DATABASE__DATABASE_NAME
        scope: RUN_TIME
        value: ${db.DATABASE}
      - key: APP_S3__ENDPOINT
        scope: RUN_TIME
        value: "???"
      - key: APP_S3__ACCESS_KEY_ID
        scope: RUN_TIME
        value: "???"
      - key: APP_S3__SECRET_ACCESS_KEY
        scope: RUN_TIME
        value: "???"
databases:
  - engine: PG
    name: db
    version: "16"
    production: true
    cluster_name: main-postgresql
    db_name: defaultdb
    db_user: doadmin