IntelliJ IDEA HTTP client ${env.VAR} placeholder limits for credential-light testing

Goal is to test an integration using IntelliJ IDEA HTTP Client without committing production API keys. The documented capability to use ${env.VAR} placeholders in headers and bodies, available from IntelliJ IDEA 2023.3 onward, suggests credential-light requests can be authored with dummy values.

Constraints include the scope of placeholder resolution, the interaction with run configurations that reference ${env.ACCESS_TOKEN}, and the reported session-only nature of OAuth2 token storage which requires re-provisioning each debugging session. There is also uncertainty about exposure of resolved values in IDE logs or shared .http files.

Does placeholder substitution apply consistently across headers, bodies, and OAuth2 pre-requests? Is the resolution limited to system environment variables or also to run-configuration environment? What controls exist to prevent resolved values from being persisted in shared configuration?