diff --git a/lib/travis/api/v3/models/env_var.rb b/lib/travis/api/v3/models/env_var.rb
index 1d4c7f8f..27f2606f 100644
--- a/lib/travis/api/v3/models/env_var.rb
+++ b/lib/travis/api/v3/models/env_var.rb
@@ -2,7 +2,7 @@ module Travis::API::V3
   class Models::EnvVar < Travis::Settings::Model
     attribute :id, Integer
     attribute :name, String
-    attribute :value, String
+    attribute :value, Travis::Settings::EncryptedValue
     attribute :public, Boolean
     attribute :repository_id, Integer
 
@@ -11,7 +11,7 @@ module Travis::API::V3
     end
 
     validates_each :id, :name do |record, attr, value|
-      others = record.repository.env_vars.select { |ev| ev.id != record.id } 
+      others = record.repository.env_vars.select { |ev| ev.id != record.id }
       record.errors.add(:base, :duplicate_resource) if others.find { |ev| ev.send(attr) == record.send(attr) }
     end
   end
diff --git a/lib/travis/api/v3/renderer.rb b/lib/travis/api/v3/renderer.rb
index 637f937d..2710fbc5 100644
--- a/lib/travis/api/v3/renderer.rb
+++ b/lib/travis/api/v3/renderer.rb
@@ -10,7 +10,7 @@ module Travis::API::V3
     extend self
 
     def clear(**args)
-      args.select { |key, value| !value.nil? }
+      args.compact
     end
 
     def href(type, string_args = nil, script_name: nil, **args)
@@ -49,6 +49,7 @@ module Travis::API::V3
       when Model                  then render_model(value, **options)
       when ActiveRecord::Relation then render_value(value.to_a, **options)
       when ActiveRecord::Associations::CollectionProxy then render_value(value.to_a, **options)
+      when Travis::Settings::EncryptedValue then value # Should this be value.decrypt ?? If so do we want to add if options[:included].first.public? so we ensure we only decrypt public values?
       else raise ArgumentError, 'cannot render %p (%p)' % [value.class, value]
       end
     end
diff --git a/lib/travis/api/v3/renderer/model_renderer.rb b/lib/travis/api/v3/renderer/model_renderer.rb
index dd5bdc0b..9df7506f 100644
--- a/lib/travis/api/v3/renderer/model_renderer.rb
+++ b/lib/travis/api/v3/renderer/model_renderer.rb
@@ -110,6 +110,7 @@ module Travis::API::V3
       end
 
       fields.each do |field|
+        next if field == :value && !@model.public?
         value  = Renderer.render_value(send(field),
                    access_control: access_control,
                    script_name:    script_name,
diff --git a/spec/v3/services/env_var/delete_spec.rb b/spec/v3/services/env_var/delete_spec.rb
index 870c69e9..96975893 100644
--- a/spec/v3/services/env_var/delete_spec.rb
+++ b/spec/v3/services/env_var/delete_spec.rb
@@ -28,6 +28,6 @@ describe Travis::API::V3::Services::EnvVar::Delete, set_app: true do
     end
 
     example { expect(last_response.status).to eq 200 }
-    example { pending 'should we return an empty body here?' }
+    example { expect(JSON.parse(last_response.body)["id"]).to eq(env_var[:id]) }
   end
 end
diff --git a/spec/v3/services/env_vars/create_spec.rb b/spec/v3/services/env_vars/create_spec.rb
index 1755e593..7a8e4587 100644
--- a/spec/v3/services/env_vars/create_spec.rb
+++ b/spec/v3/services/env_vars/create_spec.rb
@@ -13,7 +13,7 @@ describe Travis::API::V3::Services::EnvVars::Create, set_app: true do
 
   describe 'authenticated, repo missing' do
     before { post("/v3/repo/99999999/env_vars", {}, auth_headers) }
-    include_examples 'missing repo' 
+    include_examples 'missing repo'
   end
 
   describe 'authenticated, existing repo, env var already exists' do
@@ -58,7 +58,6 @@ describe Travis::API::V3::Services::EnvVars::Create, set_app: true do
         '@type' => 'env_var',
         '@representation' => 'standard',
         'name' => 'FOO',
-        'value' => 'bar',
         'public' => false
       )
       expect(response).to include('@href', 'id')