In settings.json, environment variables such as $API_KEY can be used to reference keys; Gemini expands them only at runtime, so the real key never ends up in the configuration file.