To read a secret value to an env var without writing it to disk explicitly, use:
read -sx SECRET
Don't forget to erase once you are done!
read -e SECRET
Works, but built-in completions are way better.