diff --git a/lib/travis/api/v3/renderer.rb b/lib/travis/api/v3/renderer.rb
index 2710fbc5..e31a7c77 100644
--- a/lib/travis/api/v3/renderer.rb
+++ b/lib/travis/api/v3/renderer.rb
@@ -49,7 +49,7 @@ module Travis::API::V3
       when Model                  then render_model(value, **options)
       when ActiveRecord::Relation then render_value(value.to_a, **options)
       when ActiveRecord::Associations::CollectionProxy then render_value(value.to_a, **options)
-      when Travis::Settings::EncryptedValue then value # Should this be value.decrypt ?? If so do we want to add if options[:included].first.public? so we ensure we only decrypt public values?
+      when Travis::Settings::EncryptedValue then value.decrypt
       else raise ArgumentError, 'cannot render %p (%p)' % [value.class, value]
       end
     end
diff --git a/spec/v3/services/env_var/delete_spec.rb b/spec/v3/services/env_var/delete_spec.rb
index 96975893..305b01da 100644
--- a/spec/v3/services/env_var/delete_spec.rb
+++ b/spec/v3/services/env_var/delete_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe Travis::API::V3::Services::EnvVar::Delete, set_app: true do
   let(:repo)  { Travis::API::V3::Models::Repository.where(owner_name: 'svenfuchs', name: 'minimal').first_or_create }
   let(:token) { Travis::Api::App::AccessToken.create(user: repo.owner, app_id: 1) }
-  let(:env_var) { { id: 'abc', name: 'FOO', value: 'bar', public: true, repository_id: repo.id } }
+  let(:env_var) { { id: 'abc', name: 'FOO', value: Travis::Settings::EncryptedValue.new('bar'), public: true, repository_id: repo.id } }
   let(:auth_headers) { { 'HTTP_AUTHORIZATION' => "token #{token}" } }
 
   describe 'not authenticated' do
diff --git a/spec/v3/services/env_var/find_spec.rb b/spec/v3/services/env_var/find_spec.rb
index f80cfdc1..1438ccca 100644
--- a/spec/v3/services/env_var/find_spec.rb
+++ b/spec/v3/services/env_var/find_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe Travis::API::V3::Services::EnvVar::Find, set_app: true do
   let(:repo)  { Travis::API::V3::Models::Repository.where(owner_name: 'svenfuchs', name: 'minimal').first_or_create }
   let(:token) { Travis::Api::App::AccessToken.create(user: repo.owner, app_id: 1) }
-  let(:env_var) { { id: 'abc', name: 'FOO', value: 'bar', public: true, repository_id: repo.id } }
+  let(:env_var) { { id: 'abc', name: 'FOO', value: Travis::Settings::EncryptedValue.new('bar'), public: true, repository_id: repo.id } }
   let(:auth_headers) { { 'HTTP_AUTHORIZATION' => "token #{token}" } }
 
   describe 'not authenticated' do
@@ -36,7 +36,7 @@ describe Travis::API::V3::Services::EnvVar::Find, set_app: true do
         'id' => env_var[:id],
         'name' => env_var[:name],
         'public' => env_var[:public],
-        'value' => env_var[:value]
+        'value' => env_var[:value].decrypt
       )
     end
   end
diff --git a/spec/v3/services/env_var/update_spec.rb b/spec/v3/services/env_var/update_spec.rb
index bac9a065..c4cab579 100644
--- a/spec/v3/services/env_var/update_spec.rb
+++ b/spec/v3/services/env_var/update_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe Travis::API::V3::Services::EnvVar::Update, set_app: true do
   let(:repo)  { Travis::API::V3::Models::Repository.where(owner_name: 'svenfuchs', name: 'minimal').first_or_create }
   let(:token) { Travis::Api::App::AccessToken.create(user: repo.owner, app_id: 1) }
-  let(:env_var) { { id: 'abc', name: 'FOO', value: 'bar', public: true, repository_id: repo.id } }
+  let(:env_var) { { id: 'abc', name: 'FOO', value: Travis::Settings::EncryptedValue.new('bar'), public: true, repository_id: repo.id } }
   let(:auth_headers) { { 'HTTP_AUTHORIZATION' => "token #{token}" } }
   let(:json_headers) { { 'CONTENT_TYPE' => 'application/json' } }
 
@@ -42,7 +42,7 @@ describe Travis::API::V3::Services::EnvVar::Update, set_app: true do
         '@representation' => 'standard',
         'id' => env_var[:id],
         'name' => params['env_var.name'],
-        'value' => env_var[:value],
+        'value' => env_var[:value].decrypt,
         'public' => env_var[:public]
       )
     end
diff --git a/spec/v3/services/env_vars/create_spec.rb b/spec/v3/services/env_vars/create_spec.rb
index 7a8e4587..48e82f21 100644
--- a/spec/v3/services/env_vars/create_spec.rb
+++ b/spec/v3/services/env_vars/create_spec.rb
@@ -26,7 +26,7 @@ describe Travis::API::V3::Services::EnvVars::Create, set_app: true do
     end
 
     before do
-      repo.update_attributes(settings: JSON.generate(env_vars: [{ id: 'abc', name: 'FOO', value: 'bar', public: false }]))
+      repo.update_attributes(settings: JSON.generate(env_vars: [{ id: 'abc', name: 'FOO', value: Travis::Settings::EncryptedValue.new('bar'), public: false }]))
       post("/v3/repo/#{repo.id}/env_vars", JSON.generate(params), auth_headers.merge(json_headers))
     end
 
@@ -41,26 +41,53 @@ describe Travis::API::V3::Services::EnvVars::Create, set_app: true do
   end
 
   describe 'authenticated, existing repo, env var is new' do
-    let(:params) do
-      {
-        'env_var.name' => 'FOO',
-        'env_var.value' => 'bar',
-        'env_var.public' => false
-      }
+    describe 'private' do
+      let(:params) do
+        {
+          'env_var.name' => 'FOO',
+          'env_var.value' => 'bar',
+          'env_var.public' => false
+        }
+      end
+
+      before { post("/v3/repo/#{repo.id}/env_vars", JSON.generate(params), auth_headers.merge(json_headers)) }
+
+      example { expect(last_response.status).to eq 201 }
+      example do
+        response = JSON.load(body)
+        expect(response).to include(
+          '@type' => 'env_var',
+          '@representation' => 'standard',
+          'name' => 'FOO',
+          'public' => false
+        )
+        expect(response).to include('@href', 'id')
+      end
     end
 
-    before { post("/v3/repo/#{repo.id}/env_vars", JSON.generate(params), auth_headers.merge(json_headers)) }
+    describe 'public' do
+      let(:params) do
+        {
+          'env_var.name' => 'FOO',
+          'env_var.value' => 'bar',
+          'env_var.public' => true
+        }
+      end
 
-    example { expect(last_response.status).to eq 201 }
-    example do
-      response = JSON.load(body)
-      expect(response).to include(
-        '@type' => 'env_var',
-        '@representation' => 'standard',
-        'name' => 'FOO',
-        'public' => false
-      )
-      expect(response).to include('@href', 'id')
+      before { post("/v3/repo/#{repo.id}/env_vars", JSON.generate(params), auth_headers.merge(json_headers)) }
+
+      example { expect(last_response.status).to eq 201 }
+      example do
+        response = JSON.load(body)
+        expect(response).to include(
+          '@type' => 'env_var',
+          '@representation' => 'standard',
+          'name' => 'FOO',
+          'value' => 'bar',
+          'public' => true
+        )
+        expect(response).to include('@href', 'id')
+      end
     end
   end
 end
diff --git a/spec/v3/services/env_vars/for_repository_spec.rb b/spec/v3/services/env_vars/for_repository_spec.rb
index fd20de9d..eeb4e928 100644
--- a/spec/v3/services/env_vars/for_repository_spec.rb
+++ b/spec/v3/services/env_vars/for_repository_spec.rb
@@ -3,9 +3,9 @@ require 'spec_helper'
 describe Travis::API::V3::Services::EnvVars::ForRepository, set_app: true do
   let(:repo)  { Travis::API::V3::Models::Repository.where(owner_name: 'svenfuchs', name: 'minimal').first_or_create }
   let(:token) { Travis::Api::App::AccessToken.create(user: repo.owner, app_id: 1) }
-  let(:env_var) { { id: 'abc', name: 'FOO', value: 'bar', public: true, repository_id: repo.id } }
+  let(:env_var) { { id: 'abc', name: 'FOO', value: Travis::Settings::EncryptedValue.new('bar'), public: true, repository_id: repo.id } }
   let(:auth_headers) { { 'HTTP_AUTHORIZATION' => "token #{token}" } }
-  
+
   describe 'not authenticated' do
     before { get("/v3/repo/#{repo.id}/env_vars") }
     include_examples 'not authenticated'
@@ -13,7 +13,7 @@ describe Travis::API::V3::Services::EnvVars::ForRepository, set_app: true do
 
   describe 'authenticated, missing repo' do
     before { get("/v3/repo/999999999/env_vars", {}, auth_headers) }
-    include_examples 'missing repo'  
+    include_examples 'missing repo'
   end
 
   describe 'authenticated, existing repo, no env vars' do
@@ -49,7 +49,7 @@ describe Travis::API::V3::Services::EnvVars::ForRepository, set_app: true do
             '@representation' => 'standard',
             'id' => env_var[:id],
             'name' => env_var[:name],
-            'value' => env_var[:value],
+            'value' => env_var[:value].decrypt,
             'public' => env_var[:public]
           }
         ]