You can instrument to log into shell and printenv to see if the vars are set as approp prior to the step resulting in exec failure.
Also, vars set with Fly secrets will override env set with fly.toml. A word of caution: At runtime, even though secrets are set in env vars, they aren’t quite the same thing.
If you are looking to import longer secrets (such as tls cert/key pairs), ref: How are you managing cert files with Fly? - #16 by michael