/proc/<pid>/cmdline is world-readable. Any token passed as an argument is visible to every user on the machine for as long as the process runs, and to anything sampling the process table afterwards.
1. The failure
curl -H "Authorization: Bearer $TOKEN" https://api.example.com # visible in ps2. Environment is better, not good
/proc/<pid>/environ is readable by the process owner and root only, which is a real improvement. But the value is inherited by every child, so a debugging tool that dumps its environment on crash takes the token with it.
3. Prefer a file descriptor or a file
# curl reads the header from a file, never the argv
curl --config <(printf 'header = "Authorization: Bearer %s"n' "$TOKEN")
https://api.example.comProcess substitution passes a /dev/fd path. The secret never appears in the argument list and the temporary file never exists on disk.
4. Let systemd hold it
[Service]
LoadCredential=api_token:/etc/myservice/token
ExecStart=/usr/local/bin/syncThe credential is mounted into a private tmpfs at $CREDENTIALS_DIRECTORY/api_token, readable only by that service, and gone when it stops.
5. Assume it will leak anyway
Short expiry and narrow scope do more than any amount of care with file permissions. A token that is valid for an hour and can only read one bucket is a manageable incident. A permanent admin token in a script is the incident.