diff --git a/README.md b/README.md
index 8089bc6..0bcf107 100644
--- a/README.md
+++ b/README.md
@@ -19,8 +19,8 @@ Object/file storage abstraction for the Nova ecosystem.
             adapter => nova_storage_s3,
             bucket => <<"my-uploads">>,
             region => <<"eu-west-1">>,
-            access_key => {env, "S3_ACCESS_KEY"},
-            secret_key => {env, "S3_SECRET_KEY"}
+            access_key => "S3_ACCESS_KEY",
+            secret_key => "S3_SECRET_KEY"
         }
     }}
 ]}.
diff --git a/guides/adapters.md b/guides/adapters.md
index 4ddcd47..952bde6 100644
--- a/guides/adapters.md
+++ b/guides/adapters.md
@@ -32,8 +32,8 @@ Object Storage, Minio, and B2.
 | `bucket`            | yes      | Bucket name. One store = one bucket.                        |
 | `region`            | yes      | Required for SigV4 even on non-AWS endpoints.               |
 | `endpoint`          | no       | Defaults to `https://s3.<region>.amazonaws.com`.            |
-| `access_key`        | yes      | Binary or `{env, "VAR_NAME"}`.                              |
-| `secret_key`        | yes      | Binary or `{env, "VAR_NAME"}`.                              |
+| `access_key`        | yes      | Name of the env var holding the access key (string).        |
+| `secret_key`        | yes      | Name of the env var holding the secret key (string).        |
 | `addressing_style`  | no       | `virtual` (default) or `path`. Minio needs `path`.          |
 | `session_token`     | no       | For temporary credentials.                                  |
 | `max_size`          | no       | Per-put byte ceiling. Default `infinity`.                   |
diff --git a/guides/getting-started.md b/guides/getting-started.md
index f04eacb..490dbcf 100644
--- a/guides/getting-started.md
+++ b/guides/getting-started.md
@@ -22,8 +22,8 @@
         bucket => <<"my-uploads">>,
         region => <<"eu-west-1">>,
         endpoint => <<"https://s3.eu-west-1.amazonaws.com">>,
-        access_key => {env, "S3_ACCESS_KEY"},
-        secret_key => {env, "S3_SECRET_KEY"},
+        access_key => "S3_ACCESS_KEY",
+        secret_key => "S3_SECRET_KEY",
         addressing_style => virtual
     }
 }}]}.
diff --git a/src/nova_storage.erl b/src/nova_storage.erl
index 113a29c..1c84989 100644
--- a/src/nova_storage.erl
+++ b/src/nova_storage.erl
@@ -20,8 +20,8 @@ encryption-at-rest is `nova_vault`'s job, audit is `nova_audit`'s.
             adapter => nova_storage_s3,
             bucket => <<"my-uploads">>,
             region => <<"eu-west-1">>,
-            access_key => {env, "S3_ACCESS_KEY"},
-            secret_key => {env, "S3_SECRET_KEY"}
+            access_key => "S3_ACCESS_KEY",
+            secret_key => "S3_SECRET_KEY"
         }
     }}
 ]}.
diff --git a/src/nova_storage_s3.erl b/src/nova_storage_s3.erl
index 7caf576..879b66b 100644
--- a/src/nova_storage_s3.erl
+++ b/src/nova_storage_s3.erl
@@ -14,8 +14,8 @@ B2 (S3-compatible endpoint).
     bucket => <<"my-bucket">>,
     region => <<"eu-west-1">>,
     endpoint => <<"https://s3.eu-west-1.amazonaws.com">>,  %% optional, derived for AWS
-    access_key => {env, "S3_ACCESS_KEY"},
-    secret_key => {env, "S3_SECRET_KEY"},
+    access_key => "S3_ACCESS_KEY",
+    secret_key => "S3_SECRET_KEY",
     addressing_style => virtual,  %% or path
     session_token => undefined,
     max_size => infinity
@@ -221,13 +221,13 @@ endpoint_from(Opts, Region) ->
         E when is_binary(E) -> E
     end.
 
-resolve_secret({env, VarName}) ->
+resolve_secret(VarName) when is_list(VarName) ->
     case os:getenv(VarName) of
         false -> error({env_var_not_set, VarName});
         V -> list_to_binary(V)
     end;
-resolve_secret(V) when is_binary(V) ->
-    V.
+resolve_secret(VarName) when is_binary(VarName) ->
+    resolve_secret(binary_to_list(VarName)).
 
 key_url(#handle{endpoint = Endpoint, bucket = Bucket, addressing = virtual}, Key, Query) ->
     add_query(<<(insert_subdomain(Endpoint, Bucket))/binary, "/", Key/binary>>, Query);