so far I have always set passwords and API keys by means of device service variables in the balenaCloud dashboard.
If passwords/API keys should be set in config file(s) then in start script of your docker service you must first update the config file(s) based on the passwords/API keys set by the device service variables before launching the application/service that is reading the configuration from these config file(s).