If there is someone else with access to the system, it is never safe to store a credential as an environment variable. To get around this, I try to get users to feed passwords directly to the programs they need to be entered to, or set up one-time keyfiles (such as an RSA file for SSH). Shell variables are slightly better than environment variables, since they are removed from /proc/ when the process exits.
If a variable does need to be exported, such as for use by
parallel in a sub-script, I use
export -n at the end of my script to destroy these environment variables. It is therefore important to try and catch all failures of the script, such as trapping control-c input and directing that command to a cleanup function. Failing to do so leaves these exported environment variables lingering for viewing in /proc/ in an unclean exit.
Ideally, your API has a way to tokenize your login; feeding credentials right to the API when prompted and instead storing this token as a bash variable is the superior option. Otherwise, I would say to not export the variable (since it would then be removed from /proc/ when the script PID is gone), and use
unset after you are finished with the password within the script itself. However, be aware that the variable will be visible to anyone with access to the process folder in /proc/ while the variable is set, regardless of how you clean it up.