Avoid hardcoding secrets in credentials.yml file

Yes,

telegram:
   access_token: "${TOKEN}"

Set the environment variable TOKEN to the secret value. You can set the in a .env file or another file based on the shell environment you are using.

Greg