Which JUnit 5 strategy best isolates integration tests from production credentials?

When designing an integration test suite in JUnit 5, a primary goal is to ensure that tests can execute in a CI/CD pipeline without requiring access to production API keys or sensitive credentials. While mocking external services is a common approach, it can sometimes bypass the very configuration logic the integration test is intended to verify.

There is an architectural trade-off between using @Tag to separate test suites and utilizing the JUnit 5 Extension model to inject temporary test tokens or mock credentials into the application context. The uncertainty lies in whether environment-based conditional execution via @EnabledIfEnvironmentVariable provides sufficient isolation compared to a custom BeforeEachCallback implementation.

• Does the Extension model offer a more robust way to swap credentials dynamically than environment variable checks?
• Which approach best maintains the balance between testing real configuration paths and avoiding production credential leakage?