diff --git a/cmd/principal/main.go b/cmd/principal/main.go
index b604464..72dbd94 100644
--- a/cmd/principal/main.go
+++ b/cmd/principal/main.go
@@ -28,7 +28,7 @@
 	"v.io/v23/security"
 	"v.io/v23/vom"
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/lib/v23cmd"
 	_ "v.io/x/ref/runtime/factories/static"
@@ -892,7 +892,7 @@
 	cmdBless.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "File containing bless arguments written by 'principal recvblessings -remote-arg-file FILE EXTENSION' command. This can be provided to bless in place of --remote-key, --remote-token, and <principal>")
 
 	defaultFrom := "https://dev.v.io/auth/google"
-	if e := os.Getenv(envvar.OAuthIdentityProvider); e != "" {
+	if e := os.Getenv(ref.EnvOAuthIdentityProvider); e != "" {
 		defaultFrom = e
 	}
 	cmdSeekBlessings.Flags.StringVar(&flagSeekBlessingsFrom, "from", defaultFrom, "URL to use to begin the seek blessings process")
diff --git a/cmd/principal/principal_v23_test.go b/cmd/principal/principal_v23_test.go
index 9e80947..bd8fde3 100644
--- a/cmd/principal/principal_v23_test.go
+++ b/cmd/principal/principal_v23_test.go
@@ -13,7 +13,7 @@
 	"regexp"
 	"strings"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/test/v23tests"
 )
 
@@ -658,5 +658,5 @@
 }
 
 func credEnv(dir string) string {
-	return fmt.Sprintf("%s=%s", envvar.Credentials, dir)
+	return fmt.Sprintf("%s=%s", ref.EnvCredentials, dir)
 }
diff --git a/cmd/servicerunner/main.go b/cmd/servicerunner/main.go
index aa944cc..ba2cda6 100644
--- a/cmd/servicerunner/main.go
+++ b/cmd/servicerunner/main.go
@@ -27,7 +27,7 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/signals"
 	"v.io/x/ref/runtime/factories/generic"
 	"v.io/x/ref/services/identity/identitylib"
@@ -154,8 +154,8 @@
 		return err
 	}
 
-	// Set envvar.NamespacePrefix env var, consumed downstream.
-	sh.SetVar(envvar.NamespacePrefix, vars["MT_NAME"])
+	// Set ref.EnvNamespacePrefix env var, consumed downstream.
+	sh.SetVar(ref.EnvNamespacePrefix, vars["MT_NAME"])
 	v23.GetNamespace(ctx).SetRoots(vars["MT_NAME"])
 
 	lspec := v23.GetListenSpec(ctx)
diff --git a/cmd/servicerunner/servicerunner_test.go b/cmd/servicerunner/servicerunner_test.go
index 14281ea..e99de0e 100644
--- a/cmd/servicerunner/servicerunner_test.go
+++ b/cmd/servicerunner/servicerunner_test.go
@@ -20,7 +20,7 @@
 	"path"
 	"testing"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/test"
 )
 
@@ -32,7 +32,7 @@
 }
 
 func TestServiceRunner(t *testing.T) {
-	envvar.ClearCredentials()
+	ref.EnvClearCredentials()
 	tmpdir, err := ioutil.TempDir("", "servicerunner_test")
 	if err != nil {
 		t.Fatal(err)
diff --git a/cmd/vrun/vrun.go b/cmd/vrun/vrun.go
index c34e61d..6950bfa 100644
--- a/cmd/vrun/vrun.go
+++ b/cmd/vrun/vrun.go
@@ -19,7 +19,7 @@
 	"v.io/v23/security"
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/v23cmd"
 	"v.io/x/ref/services/agent/agentlib"
 	"v.io/x/ref/services/agent/keymgr"
@@ -149,9 +149,9 @@
 		return nil, nil, err
 	}
 
-	ep, err := v23.NewEndpoint(os.Getenv(envvar.AgentEndpoint))
+	ep, err := v23.NewEndpoint(os.Getenv(ref.EnvAgentEndpoint))
 	if err != nil {
-		vlog.Errorf("Couldn't parse %v=%q: %v", envvar.AgentEndpoint, os.Getenv(envvar.AgentEndpoint), err)
+		vlog.Errorf("Couldn't parse %v=%q: %v", ref.EnvAgentEndpoint, os.Getenv(ref.EnvAgentEndpoint), err)
 		return nil, nil, err
 	}
 	// Connect to the Principal
diff --git a/cmd/vrun/vrun_v23_test.go b/cmd/vrun/vrun_v23_test.go
index cb43c0a..87ca66c 100644
--- a/cmd/vrun/vrun_v23_test.go
+++ b/cmd/vrun/vrun_v23_test.go
@@ -11,7 +11,7 @@
 	"os"
 
 	"v.io/v23/security"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/test/v23tests"
 )
@@ -101,5 +101,5 @@
 	if err := pclient.BlessingStore().SetDefault(bclient); err != nil {
 		i.Fatal(err)
 	}
-	return agentd.WithEnv(envvar.Credentials + "=" + clientDir), agentd.WithEnv(envvar.Credentials + "=" + serverDir)
+	return agentd.WithEnv(ref.EnvCredentials + "=" + clientDir), agentd.WithEnv(ref.EnvCredentials + "=" + serverDir)
 }
diff --git a/envvar.go b/envvar.go
new file mode 100644
index 0000000..31ca4bb
--- /dev/null
+++ b/envvar.go
@@ -0,0 +1,83 @@
+// Copyright 2015 The Vanadium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package ref defines constants used through the Vanadium reference
+// implementation, which is implemented in its subdirectories.
+//
+// For more details about the Vanadium project, please visit https://v.io.
+package ref
+
+import (
+	"os"
+	"strings"
+)
+
+const (
+	// EnvCredentials is the name of the environment variable pointing to a
+	// directory containing all the credentials of a principal (the blessing
+	// store, the blessing roots, possibly the private key etc.).
+	//
+	// Typically only one of EnvCredentials or EnvAgentEndpoint will be set in a
+	// process. If both are set, then EnvCredentials takes preference.
+	//
+	// See v.io/x/ref/lib/security.CreatePersistentPrincipal.
+	EnvCredentials = "V23_CREDENTIALS"
+
+	// EnvAgentEndpoint is the name of the environment variable pointing to an
+	// agentd process containing all the credentials a principal (the blessing
+	// store, the blessing roots, possibly the private key etc.).
+	//
+	// Typically only one of EnvCredentials or EnvAgentEndpoint will be set in a
+	// process. If both are set, then EnvCredentials takes preference.
+	EnvAgentEndpoint = "V23_AGENT_ENDPOINT"
+
+	// EnvNamespacePrefix is the prefix of all environment variables that define a
+	// namespace root.
+	EnvNamespacePrefix = "V23_NAMESPACE"
+
+	// EnvI18nCatalogueFiles is the name of the environment variable pointing to a
+	// comma-separated list of i18n catalogue files to be loaded at startup.
+	EnvI18nCatalogueFiles = "V23_I18N_CATALOGUE"
+
+	// EnvOAuthIdentityProvider is the name of the environment variable pointing
+	// to the url of the OAuth identity provider used by the principal
+	// seekblessings command.
+	EnvOAuthIdentityProvider = "V23_OAUTH_IDENTITY_PROVIDER"
+)
+
+// EnvNamespaceRoots returns the set of namespace roots to be used by the
+// process, as specified by environment variables.
+//
+// It returns both a map of environment variable name to value and the list of
+// values.
+func EnvNamespaceRoots() (map[string]string, []string) {
+	m := make(map[string]string)
+	var l []string
+	for _, ev := range os.Environ() {
+		p := strings.SplitN(ev, "=", 2)
+		if len(p) != 2 {
+			continue
+		}
+		k, v := p[0], p[1]
+		if strings.HasPrefix(k, EnvNamespacePrefix) && len(v) > 0 {
+			l = append(l, v)
+			m[k] = v
+		}
+	}
+	return m, l
+}
+
+// EnvClearCredentials unsets all environment variables that are used by the
+// Runtime to intialize the principal.
+func EnvClearCredentials() error {
+	for _, v := range []string{
+		EnvCredentials,
+		EnvAgentEndpoint,
+	} {
+		if err := os.Unsetenv(v); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/envvar/envvar.go b/envvar/envvar.go
deleted file mode 100644
index 1f20fa7..0000000
--- a/envvar/envvar.go
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package envvar defines the environment variables used by the reference v23
-// implementation.
-package envvar
-
-import (
-	"os"
-	"strings"
-)
-
-const (
-	// Credentials points to a directory containing all the credentials of
-	// a principal (the blessing store, the blessing roots, possibly the
-	// private key etc.).
-	//
-	// Typically only one of Credentials or AgentEndpoint will be set
-	// in a process. If both are set, then Credentials takes preference.
-	//
-	// See v.io/x/ref/lib/security.CreatePersistentPrincipal.
-	Credentials = "V23_CREDENTIALS"
-
-	// AgentEndpoint points to an agentd process containing all the
-	// credentials a principal (the blessing store, the blessing roots,
-	// possibly the private key etc.).
-	//
-	// Typically only one of Credentials or AgentEndpoint will be set
-	// in a process. If both are set, then Credentials takes preference.
-	AgentEndpoint = "V23_AGENT_ENDPOINT"
-
-	// NamespacePrefix is the prefix of all environment variables that define
-	// a namespace root.
-	NamespacePrefix = "V23_NAMESPACE"
-
-	// I18nCatalogueFiles points to a comma-separated list of i18n
-	// catalogue files to be loaded at startup.
-	I18nCatalogueFiles = "V23_I18N_CATALOGUE"
-
-	// OAuthIdentityProvider points to the url of the OAuth identity
-	// provider used by the principal seekblessings command.
-	OAuthIdentityProvider = "V23_OAUTH_IDENTITY_PROVIDER"
-)
-
-// NamespaceRoots returns the set of namespace roots to be used by the process,
-// as specified by environment variables.
-//
-// It returns both a map of environment variable name to value and the list of
-// values.
-func NamespaceRoots() (map[string]string, []string) {
-	m := make(map[string]string)
-	var l []string
-	for _, ev := range os.Environ() {
-		p := strings.SplitN(ev, "=", 2)
-		if len(p) != 2 {
-			continue
-		}
-		k, v := p[0], p[1]
-		if strings.HasPrefix(k, NamespacePrefix) && len(v) > 0 {
-			l = append(l, v)
-			m[k] = v
-		}
-	}
-	return m, l
-}
-
-// ClearCredentials unsets all environment variables that are used by
-// the Runtime to intialize the principal.
-func ClearCredentials() error {
-	for _, v := range []string{
-		Credentials,
-		AgentEndpoint,
-	} {
-		if err := os.Unsetenv(v); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/envvar/envvar_test.go b/envvar_test.go
similarity index 71%
rename from envvar/envvar_test.go
rename to envvar_test.go
index e0fa19c..8d1d8f1 100644
--- a/envvar/envvar_test.go
+++ b/envvar_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package envvar
+package ref
 
 import (
 	"os"
@@ -26,9 +26,9 @@
 	}
 }
 
-func TestNamespaceRoots(t *testing.T) {
-	defer setenv(t, NamespacePrefix, "NS1")()
-	defer setenv(t, NamespacePrefix+"_BLAH", "NS_BLAH")()
+func TestEnvNamespaceRoots(t *testing.T) {
+	defer setenv(t, EnvNamespacePrefix, "NS1")()
+	defer setenv(t, EnvNamespacePrefix+"_BLAH", "NS_BLAH")()
 
 	wantm := map[string]string{
 		"V23_NAMESPACE":      "NS1",
@@ -36,7 +36,7 @@
 	}
 	wantl := []string{"NS1", "NS_BLAH"}
 
-	gotm, gotl := NamespaceRoots()
+	gotm, gotl := EnvNamespaceRoots()
 	if !reflect.DeepEqual(wantm, gotm) {
 		t.Errorf("Got %v want %v", gotm, wantm)
 	}
@@ -45,13 +45,13 @@
 	}
 }
 
-func TestClearCredentials(t *testing.T) {
-	defer setenv(t, Credentials, "FOO")()
-	if got, want := os.Getenv(Credentials), "FOO"; got != want {
+func TestEnvClearCredentials(t *testing.T) {
+	defer setenv(t, EnvCredentials, "FOO")()
+	if got, want := os.Getenv(EnvCredentials), "FOO"; got != want {
 		t.Errorf("Got %q, want %q", got, want)
 	}
-	ClearCredentials()
-	if got := os.Getenv(Credentials); got != "" {
+	EnvClearCredentials()
+	if got := os.Getenv(EnvCredentials); got != "" {
 		t.Errorf("Got %q, wanted empty string", got)
 	}
 }
diff --git a/examples/tunnel/tunneld/tunneld_v23_test.go b/examples/tunnel/tunneld/tunneld_v23_test.go
index cf8ef05..195a871 100644
--- a/examples/tunnel/tunneld/tunneld_v23_test.go
+++ b/examples/tunnel/tunneld/tunneld_v23_test.go
@@ -11,7 +11,7 @@
 	"io/ioutil"
 	"path/filepath"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/test/v23tests"
 )
 
@@ -57,7 +57,7 @@
 	}
 
 	// Verify that all published names are there.
-	root, _ := t.GetVar(envvar.NamespacePrefix)
+	root, _ := t.GetVar(ref.EnvNamespacePrefix)
 	inv := mounttableBin.Start("glob", root, "tunnel/test")
 
 	// Expect one entry: the tunnel name.
diff --git a/lib/flags/flags.go b/lib/flags/flags.go
index d459483..68211e5 100644
--- a/lib/flags/flags.go
+++ b/lib/flags/flags.go
@@ -12,7 +12,7 @@
 	"sync"
 
 	"v.io/v23/verror"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 )
 
 const pkgPath = "v.io/x/ref/lib/flags"
@@ -121,16 +121,16 @@
 
 // RuntimeFlags contains the values of the Runtime flag group.
 type RuntimeFlags struct {
-	// NamespaceRoots may be initialized by envvar.NamespacePrefix* enivornment
+	// NamespaceRoots may be initialized by ref.EnvNamespacePrefix* enivornment
 	// variables as well as --v23.namespace.root. The command line
 	// will override the environment.
 	NamespaceRoots []string
 
-	// Credentials may be initialized by the envvar.Credentials
+	// Credentials may be initialized by the ref.EnvCredentials
 	// environment variable. The command line will override the environment.
 	Credentials string // TODO(cnicolaou): provide flag.Value impl
 
-	// I18nCatalogue may be initialized by the envvar.I18nCatalogueFiles
+	// I18nCatalogue may be initialized by the ref.EnvI18nCatalogueFiles
 	// environment variable.  The command line will override the
 	// environment.
 	I18nCatalogue string
@@ -262,9 +262,9 @@
 func createAndRegisterRuntimeFlags(fs *flag.FlagSet) *RuntimeFlags {
 	var (
 		f             = &RuntimeFlags{}
-		_, roots      = envvar.NamespaceRoots()
-		creds         = os.Getenv(envvar.Credentials)
-		i18nCatalogue = os.Getenv(envvar.I18nCatalogueFiles)
+		_, roots      = ref.EnvNamespaceRoots()
+		creds         = os.Getenv(ref.EnvCredentials)
+		i18nCatalogue = os.Getenv(ref.EnvI18nCatalogueFiles)
 	)
 	if len(roots) == 0 {
 		f.namespaceRootsFlag.roots = []string{defaultNamespaceRoot}
diff --git a/lib/flags/flags_test.go b/lib/flags/flags_test.go
index 37508db..fd3ac19 100644
--- a/lib/flags/flags_test.go
+++ b/lib/flags/flags_test.go
@@ -11,7 +11,7 @@
 	"reflect"
 	"testing"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/flags"
 )
 
@@ -139,20 +139,20 @@
 }
 
 const (
-	rootEnvVar  = envvar.NamespacePrefix
-	rootEnvVar0 = envvar.NamespacePrefix + "0"
+	rootEnvVar  = ref.EnvNamespacePrefix
+	rootEnvVar0 = ref.EnvNamespacePrefix + "0"
 )
 
 func TestEnvVars(t *testing.T) {
-	oldcreds := os.Getenv(envvar.Credentials)
-	defer os.Setenv(envvar.Credentials, oldcreds)
+	oldcreds := os.Getenv(ref.EnvCredentials)
+	defer os.Setenv(ref.EnvCredentials, oldcreds)
 
 	oldroot := os.Getenv(rootEnvVar)
 	oldroot0 := os.Getenv(rootEnvVar0)
 	defer os.Setenv(rootEnvVar, oldroot)
 	defer os.Setenv(rootEnvVar0, oldroot0)
 
-	os.Setenv(envvar.Credentials, "bar")
+	os.Setenv(ref.EnvCredentials, "bar")
 	fl := flags.CreateAndRegister(flag.NewFlagSet("test", flag.ContinueOnError), flags.Runtime)
 	if err := fl.Parse([]string{}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
diff --git a/runtime/internal/rpc/test/client_test.go b/runtime/internal/rpc/test/client_test.go
index 0343ad9..a1e9013 100644
--- a/runtime/internal/rpc/test/client_test.go
+++ b/runtime/internal/rpc/test/client_test.go
@@ -23,7 +23,7 @@
 	"v.io/v23/security"
 	"v.io/v23/vdlroot/signature"
 	"v.io/v23/verror"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	_ "v.io/x/ref/runtime/factories/generic"
 	inaming "v.io/x/ref/runtime/internal/naming"
 	irpc "v.io/x/ref/runtime/internal/rpc"
@@ -165,7 +165,7 @@
 	root.ExpectVar("PID")
 	rootName := root.ExpectVar("MT_NAME")
 
-	sh.SetVar(envvar.NamespacePrefix, rootName)
+	sh.SetVar(ref.EnvNamespacePrefix, rootName)
 	if err = v23.GetNamespace(ctx).SetRoots(rootName); err != nil {
 		t.Fatalf("unexpected error setting namespace roots: %s", err)
 	}
diff --git a/runtime/internal/rt/rt_test.go b/runtime/internal/rt/rt_test.go
index f3fdf65..3e53548 100644
--- a/runtime/internal/rt/rt_test.go
+++ b/runtime/internal/rt/rt_test.go
@@ -17,7 +17,7 @@
 	"v.io/v23/context"
 	"v.io/v23/security"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/expect"
@@ -27,7 +27,7 @@
 //go:generate v23 test generate
 
 func TestInit(t *testing.T) {
-	envvar.ClearCredentials()
+	ref.EnvClearCredentials()
 	ctx, shutdown := v23.Init()
 	defer shutdown()
 
@@ -184,7 +184,7 @@
 	createCredentialsInDir(t, cdir, "test")
 
 	// directory supplied by the environment.
-	credEnv := []string{envvar.Credentials + "=" + cdir}
+	credEnv := []string{ref.EnvCredentials + "=" + cdir}
 
 	h, err := sh.Start("runner", credEnv)
 	if err != nil {
@@ -220,9 +220,9 @@
 
 	// A credentials directory may, or may, not have been already specified.
 	// Either way, we want to use our own, so we set it aside and use our own.
-	origCredentialsDir := os.Getenv(envvar.Credentials)
-	defer os.Setenv(envvar.Credentials, origCredentialsDir)
-	if err := os.Setenv(envvar.Credentials, ""); err != nil {
+	origCredentialsDir := os.Getenv(ref.EnvCredentials)
+	defer os.Setenv(ref.EnvCredentials, origCredentialsDir)
+	if err := os.Setenv(ref.EnvCredentials, ""); err != nil {
 		t.Fatal(err)
 	}
 
@@ -243,7 +243,7 @@
 	}
 	defer agentSh.Cleanup(os.Stderr, os.Stderr)
 
-	// Test that with envvar.Credentials unset the runtime's Principal
+	// Test that with ref.EnvCredentials unset the runtime's Principal
 	// is correctly initialized for both shells.
 	if len(collect(sh, nil)) == 0 {
 		t.Fatalf("Without agent: child returned an empty default blessings set")
@@ -252,12 +252,12 @@
 		t.Fatalf("With agent: got %q, want %q", got, want)
 	}
 
-	// Test that credentials specified via the envvar.Credentials
+	// Test that credentials specified via the ref.EnvCredentials
 	// environment variable take precedence over an agent.
 	cdir1 := tmpDir(t)
 	defer os.RemoveAll(cdir1)
 	createCredentialsInDir(t, cdir1, "test_env")
-	credEnv := []string{envvar.Credentials + "=" + cdir1}
+	credEnv := []string{ref.EnvCredentials + "=" + cdir1}
 
 	if got, want := collect(sh, credEnv), "test_env"; got != want {
 		t.Errorf("Without agent: got default blessings: %q, want %q", got, want)
@@ -267,7 +267,7 @@
 	}
 
 	// Test that credentials specified via the command line take precedence over the
-	// envvar.Credentials environment variable and also the agent.
+	// ref.EnvCredentials environment variable and also the agent.
 	cdir2 := tmpDir(t)
 	defer os.RemoveAll(cdir2)
 	createCredentialsInDir(t, cdir2, "test_cmd")
diff --git a/runtime/internal/rt/security.go b/runtime/internal/rt/security.go
index 9d46d42..ef1d822 100644
--- a/runtime/internal/rt/security.go
+++ b/runtime/internal/rt/security.go
@@ -15,7 +15,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/security"
 	"v.io/v23/verror"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/exec"
 	"v.io/x/ref/lib/mgmt"
 	vsecurity "v.io/x/ref/lib/security"
@@ -34,7 +34,7 @@
 		}
 		// TODO(ataly, ashankar): If multiple runtimes are getting
 		// initialized at the same time from the same
-		// envvar.Credentials we will need some kind of locking for the
+		// ref.EnvCredentials we will need some kind of locking for the
 		// credential files.
 		if principal, err = vsecurity.LoadPersistentPrincipal(credentials, nil); err != nil {
 			if os.IsNotExist(err) {
@@ -108,7 +108,7 @@
 		// We were started by a parent (presumably, device manager).
 		endpoint, _ = handle.Config.Get(mgmt.SecurityAgentEndpointConfigKey)
 	} else {
-		endpoint = os.Getenv(envvar.AgentEndpoint)
+		endpoint = os.Getenv(ref.EnvAgentEndpoint)
 	}
 	if endpoint == "" {
 		return nil, -1, nil
diff --git a/services/agent/agentd/main.go b/services/agent/agentd/main.go
index 7a0c214..ab469e7 100644
--- a/services/agent/agentd/main.go
+++ b/services/agent/agentd/main.go
@@ -24,7 +24,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vsecurity "v.io/x/ref/lib/security"
 	vsignals "v.io/x/ref/lib/signals"
 	"v.io/x/ref/services/agent/internal/server"
@@ -70,7 +70,7 @@
 Loads the private key specified in privatekey.pem in %v into memory, then
 starts the specified command with access to the private key via the
 agent protocol instead of directly reading from disk.
-`, envvar.Credentials),
+`, ref.EnvCredentials),
 	ArgsName: "command [command_args...]",
 	ArgsLong: `
 The command is started as a subprocess with the given [command_args...].
@@ -90,7 +90,7 @@
 	// v23.credentials flag.  However we need to parse it before
 	// creating the runtime.  We depend on the profile's init() function
 	// calling flags.CreateAndRegister(flag.CommandLine, flags.Runtime)
-	// This will read the envvar.Credentials env var, then our call to
+	// This will read the ref.EnvCredentials env var, then our call to
 	// flag.Parse() will take any override passed on the command line.
 	var dir string
 	if f := flag.Lookup("v23.credentials").Value; true {
@@ -100,7 +100,7 @@
 		f.Set("")
 	}
 	if len(dir) == 0 {
-		return env.UsageErrorf("The %v environment variable must be set to a directory: %q", envvar.Credentials, os.Getenv(envvar.Credentials))
+		return env.UsageErrorf("The %v environment variable must be set to a directory: %q", ref.EnvCredentials, os.Getenv(ref.EnvCredentials))
 	}
 
 	p, passphrase, err := newPrincipalFromDir(dir)
@@ -109,8 +109,8 @@
 	}
 
 	// Clear out the environment variable before v23.Init.
-	if err = envvar.ClearCredentials(); err != nil {
-		return fmt.Errorf("envvar.ClearCredentials: %v", err)
+	if err = ref.EnvClearCredentials(); err != nil {
+		return fmt.Errorf("ref.EnvClearCredentials: %v", err)
 	}
 	ctx, shutdown := v23.Init()
 	defer shutdown()
@@ -133,7 +133,7 @@
 	if sock, endpoint, err = server.RunAnonymousAgent(ctx, p, childAgentFd); err != nil {
 		return fmt.Errorf("RunAnonymousAgent: %v", err)
 	}
-	if err = os.Setenv(envvar.AgentEndpoint, endpoint); err != nil {
+	if err = os.Setenv(ref.EnvAgentEndpoint, endpoint); err != nil {
 		return fmt.Errorf("setenv: %v", err)
 	}
 
diff --git a/services/agent/agentlib/agent_v23_test.go b/services/agent/agentlib/agent_v23_test.go
index dcd9646..8b84787 100644
--- a/services/agent/agentlib/agent_v23_test.go
+++ b/services/agent/agentlib/agent_v23_test.go
@@ -14,7 +14,7 @@
 	"text/template"
 
 	"v.io/v23/security"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/test/v23tests"
 )
@@ -22,7 +22,7 @@
 //go:generate v23 test generate
 
 func V23TestTestPassPhraseUse(i *v23tests.T) {
-	bin := i.BuildGoPkg("v.io/x/ref/services/agent/agentd").WithEnv(envvar.Credentials + "=" + i.NewTempDir(""))
+	bin := i.BuildGoPkg("v.io/x/ref/services/agent/agentd").WithEnv(ref.EnvCredentials + "=" + i.NewTempDir(""))
 
 	// Create the passphrase
 	agent := bin.Start("echo", "Hello")
@@ -68,7 +68,7 @@
 	// (Errors are printed to STDERR)
 	testbin := i.BuildGoPkg("v.io/x/ref/services/agent/internal/test_principal").Path()
 	i.BuildGoPkg("v.io/x/ref/services/agent/agentd").
-		WithEnv(envvar.Credentials+"="+i.NewTempDir("")).
+		WithEnv(ref.EnvCredentials+"="+i.NewTempDir("")).
 		Start(testbin).
 		WaitOrDie(nil, os.Stderr)
 }
@@ -261,5 +261,5 @@
 	if err := pclient.AddToRoots(bserver); err != nil {
 		i.Fatal(err)
 	}
-	return agentd.WithEnv(envvar.Credentials + "=" + clientDir), agentd.WithEnv(envvar.Credentials + "=" + serverDir)
+	return agentd.WithEnv(ref.EnvCredentials + "=" + clientDir), agentd.WithEnv(ref.EnvCredentials + "=" + serverDir)
 }
diff --git a/services/agent/internal/test_principal/main.go b/services/agent/internal/test_principal/main.go
index 120e55f..baab5e8 100644
--- a/services/agent/internal/test_principal/main.go
+++ b/services/agent/internal/test_principal/main.go
@@ -20,7 +20,7 @@
 	"v.io/v23/context"
 	"v.io/v23/security"
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/v23cmd"
 
 	_ "v.io/x/ref/runtime/factories/generic"
@@ -56,11 +56,11 @@
 	// Make sure we're running under a pristine agent to begin with.
 	// The agent aims to be transparent, so use a collection of heuristics
 	// to detect this.
-	if got := os.Getenv(envvar.Credentials); len(got) != 0 {
-		errorf("%v environment variable is unexpectedly set", envvar.Credentials)
+	if got := os.Getenv(ref.EnvCredentials); len(got) != 0 {
+		errorf("%v environment variable is unexpectedly set", ref.EnvCredentials)
 	}
-	if got := os.Getenv(envvar.AgentEndpoint); len(got) == 0 {
-		errorf("%v environment variable is not set", envvar.AgentEndpoint)
+	if got := os.Getenv(ref.EnvAgentEndpoint); len(got) == 0 {
+		errorf("%v environment variable is not set", ref.EnvAgentEndpoint)
 	}
 	// A pristine agent has a single blessing "agent_principal" (from agentd/main.go).
 	if blessings := p.BlessingsInfo(p.BlessingStore().Default()); len(blessings) != 1 {
diff --git a/services/agent/vbecome/vbecome.go b/services/agent/vbecome/vbecome.go
index b4cd9f6..5c56b82 100644
--- a/services/agent/vbecome/vbecome.go
+++ b/services/agent/vbecome/vbecome.go
@@ -23,7 +23,7 @@
 	"v.io/v23/security"
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/lib/v23cmd"
 	"v.io/x/ref/services/agent/internal/server"
@@ -113,7 +113,7 @@
 	if err != nil {
 		return err
 	}
-	if err = os.Setenv(envvar.AgentEndpoint, endpoint); err != nil {
+	if err = os.Setenv(ref.EnvAgentEndpoint, endpoint); err != nil {
 		vlog.Fatalf("setenv: %v", err)
 	}
 
diff --git a/services/device/internal/config/config.go b/services/device/internal/config/config.go
index b8c323c..491c2e3 100644
--- a/services/device/internal/config/config.go
+++ b/services/device/internal/config/config.go
@@ -28,10 +28,9 @@
 	"path/filepath"
 	"strings"
 
-	"v.io/x/ref/envvar"
-
 	"v.io/v23/services/application"
 	"v.io/v23/verror"
+	"v.io/x/ref"
 )
 
 const pkgPath = "v.io/x/ref/services/device/internal/config"
@@ -141,7 +140,7 @@
 	// We need to manually pass the namespace roots to the child, since we
 	// currently don't have a way for the child to obtain this information
 	// from a config service at start-up.
-	roots, _ := envvar.NamespaceRoots()
+	roots, _ := ref.EnvNamespaceRoots()
 	var ret []string
 	for k, v := range roots {
 		ret = append(ret, k+"="+v)
diff --git a/services/device/internal/impl/app_service.go b/services/device/internal/impl/app_service.go
index 9d6ab22..5b6a762 100644
--- a/services/device/internal/impl/app_service.go
+++ b/services/device/internal/impl/app_service.go
@@ -143,7 +143,7 @@
 	"v.io/v23/services/device"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vexec "v.io/x/ref/lib/exec"
 	"v.io/x/ref/lib/mgmt"
 	vsecurity "v.io/x/ref/lib/security"
@@ -759,7 +759,7 @@
 	saArgs.progname = appName
 
 	// Set the app's default namespace root to the local namespace.
-	saArgs.env = []string{envvar.NamespacePrefix + "=" + nsRoot}
+	saArgs.env = []string{ref.EnvNamespacePrefix + "=" + nsRoot}
 	saArgs.env = append(saArgs.env, envelope.Env...)
 	rootDir := filepath.Join(instanceDir, "root")
 	saArgs.dir = rootDir
@@ -849,7 +849,7 @@
 		ep := agentlib.AgentEndpoint(fd)
 		cfg.Set(mgmt.SecurityAgentEndpointConfigKey, ep)
 	} else {
-		cmd.Env = append(cmd.Env, envvar.Credentials+"="+filepath.Join(instanceDir, "credentials"))
+		cmd.Env = append(cmd.Env, ref.EnvCredentials+"="+filepath.Join(instanceDir, "credentials"))
 	}
 	handle := vexec.NewParentHandle(cmd, vexec.ConfigOpt{cfg})
 	defer func() {
diff --git a/services/device/internal/impl/applife/app_life_test.go b/services/device/internal/impl/applife/app_life_test.go
index f47c6a3..f336bb2 100644
--- a/services/device/internal/impl/applife/app_life_test.go
+++ b/services/device/internal/impl/applife/app_life_test.go
@@ -17,8 +17,7 @@
 
 	"v.io/v23/naming"
 	"v.io/v23/services/device"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/mgmt"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/impl/utiltest"
@@ -96,7 +95,7 @@
 	// should override the value specified in the envelope above, and the
 	// config-specified value for origin should override the value in the
 	// Install rpc argument.
-	mtName, ok := sh.GetVar(envvar.NamespacePrefix)
+	mtName, ok := sh.GetVar(ref.EnvNamespacePrefix)
 	if !ok {
 		t.Fatalf("failed to get namespace root var from shell")
 	}
diff --git a/services/device/internal/impl/device_installer.go b/services/device/internal/impl/device_installer.go
index 8846d4d..030c0ea 100644
--- a/services/device/internal/impl/device_installer.go
+++ b/services/device/internal/impl/device_installer.go
@@ -55,8 +55,7 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/services/application"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/sysinit"
 )
@@ -134,8 +133,8 @@
 // SelfInstall installs the device manager and configures it using the
 // environment and the supplied command-line flags.
 func SelfInstall(installDir, suidHelper, agent, initHelper, origin string, singleUser, sessionMode, init bool, args, env []string, stderr, stdout io.Writer) error {
-	if os.Getenv(envvar.Credentials) != "" {
-		return fmt.Errorf("Attempting to install device manager under agent with the %q environment variable set.", envvar.Credentials)
+	if os.Getenv(ref.EnvCredentials) != "" {
+		return fmt.Errorf("Attempting to install device manager under agent with the %q environment variable set.", ref.EnvCredentials)
 	}
 	root := filepath.Join(installDir, dmRoot)
 	if _, err := os.Stat(root); err == nil || !os.IsNotExist(err) {
@@ -253,7 +252,7 @@
 	output += fmt.Sprintf("  TIMESTAMP=$(%s)\n", dateCommand)
 	output += fmt.Sprintf("  exec > %s-$TIMESTAMP 2> %s-$TIMESTAMP\n", stdoutLog, stderrLog)
 	output += "fi\n"
-	output += fmt.Sprintf("%s=%q ", envvar.Credentials, principalDir)
+	output += fmt.Sprintf("%s=%q ", ref.EnvCredentials, principalDir)
 	// Escape the path to the binary; %q uses Go-syntax escaping, but it's
 	// close enough to Bash that we're using it as an approximation.
 	//
@@ -301,8 +300,8 @@
 		return nil
 	}
 
-	if os.Getenv(envvar.Credentials) != "" {
-		return fmt.Errorf("Attempting to run device manager under agent with the %q environment variable set.", envvar.Credentials)
+	if os.Getenv(ref.EnvCredentials) != "" {
+		return fmt.Errorf("Attempting to run device manager under agent with the %q environment variable set.", ref.EnvCredentials)
 	}
 	agentScript := filepath.Join(root, "agent_deviced.sh")
 	cmd := exec.Command(agentScript)
diff --git a/services/device/internal/impl/device_service.go b/services/device/internal/impl/device_service.go
index 58bc028..c51a687 100644
--- a/services/device/internal/impl/device_service.go
+++ b/services/device/internal/impl/device_service.go
@@ -63,7 +63,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/metadata"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	vexec "v.io/x/ref/lib/exec"
 	"v.io/x/ref/lib/mgmt"
 	vsecurity "v.io/x/ref/lib/security"
@@ -363,7 +363,7 @@
 		if p, err = vsecurity.CreatePersistentPrincipal(credentialsDir, nil); err != nil {
 			return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("CreatePersistentPrincipal(%v, nil) failed: %v", credentialsDir, err))
 		}
-		cmd.Env = append(cmd.Env, envvar.Credentials+"="+credentialsDir)
+		cmd.Env = append(cmd.Env, ref.EnvCredentials+"="+credentialsDir)
 	}
 	dmPrincipal := v23.GetPrincipal(ctx)
 	dmBlessings, err := dmPrincipal.Bless(p.PublicKey(), dmPrincipal.BlessingStore().Default(), "testdm", security.UnconstrainedUse())
diff --git a/services/device/internal/impl/dispatcher.go b/services/device/internal/impl/dispatcher.go
index f62e8ef..8c506e1 100644
--- a/services/device/internal/impl/dispatcher.go
+++ b/services/device/internal/impl/dispatcher.go
@@ -25,7 +25,7 @@
 	"v.io/v23/vdlroot/signature"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/services/agent/keymgr"
 	s_device "v.io/x/ref/services/device"
 	"v.io/x/ref/services/device/internal/config"
@@ -138,7 +138,7 @@
 	}
 
 	// If we're in 'security agent mode', set up the key manager agent.
-	if len(os.Getenv(envvar.AgentEndpoint)) > 0 {
+	if len(os.Getenv(ref.EnvAgentEndpoint)) > 0 {
 		if keyMgrAgent, err := keymgr.NewAgent(); err != nil {
 			return nil, verror.New(errNewAgentFailed, ctx, err)
 		} else {
diff --git a/services/device/internal/impl/impl_test.go b/services/device/internal/impl/impl_test.go
index 87b4cd9..14425d8 100644
--- a/services/device/internal/impl/impl_test.go
+++ b/services/device/internal/impl/impl_test.go
@@ -22,8 +22,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/application"
 	"v.io/v23/services/device"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/impl/utiltest"
@@ -107,7 +106,7 @@
 		t.Fatal(err)
 	}
 	defer os.RemoveAll(dmCreds)
-	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds)}
+	dmEnv := []string{fmt.Sprintf("%v=%v", ref.EnvCredentials, dmCreds)}
 	dmArgs := []string{"factoryDM", root, "unused_helper", utiltest.MockApplicationRepoName, currLink}
 	args, env := sh.CommandEnvelope(utiltest.DeviceManagerCmd, dmEnv, dmArgs...)
 	scriptPathFactory := generateDeviceManagerScript(t, root, args, env)
diff --git a/services/device/internal/impl/instance_reaping_kill_test.go b/services/device/internal/impl/instance_reaping_kill_test.go
index e702a4c..8e6c68b 100644
--- a/services/device/internal/impl/instance_reaping_kill_test.go
+++ b/services/device/internal/impl/instance_reaping_kill_test.go
@@ -13,8 +13,7 @@
 	"time"
 
 	"v.io/v23/services/device"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/services/device/internal/impl/utiltest"
 	"v.io/x/ref/services/internal/servicetest"
 )
@@ -31,7 +30,7 @@
 		t.Fatal(err)
 	}
 	defer os.RemoveAll(dmCreds)
-	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds)}
+	dmEnv := []string{fmt.Sprintf("%v=%v", ref.EnvCredentials, dmCreds)}
 
 	dmh := servicetest.RunCommand(t, sh, dmEnv, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	servicetest.ReadPID(t, dmh)
diff --git a/services/device/internal/impl/reaping/instance_reaping_test.go b/services/device/internal/impl/reaping/instance_reaping_test.go
index f3378db..7dd0c55 100644
--- a/services/device/internal/impl/reaping/instance_reaping_test.go
+++ b/services/device/internal/impl/reaping/instance_reaping_test.go
@@ -13,8 +13,7 @@
 	"time"
 
 	"v.io/v23/services/device"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/impl/utiltest"
 	"v.io/x/ref/services/internal/servicetest"
@@ -32,7 +31,7 @@
 		t.Fatal(err)
 	}
 	defer os.RemoveAll(dmCreds)
-	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds), fmt.Sprintf("%v=%v", impl.AppcycleReconciliation, "1")}
+	dmEnv := []string{fmt.Sprintf("%v=%v", ref.EnvCredentials, dmCreds), fmt.Sprintf("%v=%v", impl.AppcycleReconciliation, "1")}
 
 	dmh := servicetest.RunCommand(t, sh, dmEnv, utiltest.DeviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	servicetest.ReadPID(t, dmh)
diff --git a/services/device/internal/impl/utiltest/helpers.go b/services/device/internal/impl/utiltest/helpers.go
index d7e262b..0f2305a 100644
--- a/services/device/internal/impl/utiltest/helpers.go
+++ b/services/device/internal/impl/utiltest/helpers.go
@@ -32,8 +32,7 @@
 	"v.io/v23/services/pprof"
 	"v.io/v23/services/stats"
 	"v.io/v23/verror"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	_ "v.io/x/ref/runtime/factories/roaming"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/internal/binarylib"
@@ -685,7 +684,7 @@
 }
 
 func InitForTest() (*context.T, v23.Shutdown) {
-	roots, _ := envvar.NamespaceRoots()
+	roots, _ := ref.EnvNamespaceRoots()
 	for key, _ := range roots {
 		os.Unsetenv(key)
 	}
diff --git a/services/device/mgmt_v23_test.go b/services/device/mgmt_v23_test.go
index 31fce30..c07c9da 100644
--- a/services/device/mgmt_v23_test.go
+++ b/services/device/mgmt_v23_test.go
@@ -47,7 +47,7 @@
 	"strings"
 	"time"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	_ "v.io/x/ref/runtime/factories/generic"
 	"v.io/x/ref/test/v23tests"
 )
@@ -422,7 +422,7 @@
 	if namespaceBin.Run("resolve", n) == "" {
 		i.Fatalf("failed to resolve %s", n)
 	}
-	namespaceRoot, _ := i.GetVar(envvar.NamespacePrefix)
+	namespaceRoot, _ := i.GetVar(ref.EnvNamespacePrefix)
 	n = mtEP + "/global"
 	if got, want := namespaceBin.Run("resolve", n), namespaceRoot; got != want {
 		i.Fatalf("got %q, want %q", got, want)
diff --git a/services/internal/servicetest/modules.go b/services/internal/servicetest/modules.go
index 6cc9400..7954346 100644
--- a/services/internal/servicetest/modules.go
+++ b/services/internal/servicetest/modules.go
@@ -19,8 +19,7 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/x/lib/vlog"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/services/mounttable/mounttablelib"
 	"v.io/x/ref/test/modules"
 	"v.io/x/ref/test/testutil"
@@ -99,7 +98,7 @@
 	opts.ExpectTimeout = ExpectTimeout
 	sh.SetDefaultStartOpts(opts)
 	// The shell, will, by default share credentials with its children.
-	sh.ClearVar(envvar.Credentials)
+	sh.ClearVar(ref.EnvCredentials)
 
 	mtName, _ := startRootMT(t, sh)
 	vlog.VI(1).Infof("Started shell mounttable with name %v", mtName)
@@ -119,7 +118,7 @@
 		setNSRoots(t, ctx, oldNamespaceRoots...)
 	}
 	setNSRoots(t, ctx, mtName)
-	sh.SetVar(envvar.NamespacePrefix, mtName)
+	sh.SetVar(ref.EnvNamespacePrefix, mtName)
 	return sh, fn
 }
 
diff --git a/services/mounttable/mounttabled/mounttabled_v23_test.go b/services/mounttable/mounttabled/mounttabled_v23_test.go
index 4c8c16f..9b86b10 100644
--- a/services/mounttable/mounttabled/mounttabled_v23_test.go
+++ b/services/mounttable/mounttabled/mounttabled_v23_test.go
@@ -9,7 +9,7 @@
 	"os"
 	"regexp"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/test/v23tests"
 )
 
@@ -37,7 +37,7 @@
 	neighborhood := fmt.Sprintf("test-%s-%d", getHostname(i), os.Getpid())
 	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0", "--neighborhood-name="+neighborhood)
 
-	name, _ := i.GetVar(envvar.NamespacePrefix)
+	name, _ := i.GetVar(ref.EnvNamespacePrefix)
 	clientBin := binaryWithCredentials(i, "cmd", "v.io/x/ref/cmd/mounttable")
 
 	// Get the neighborhood endpoint from the mounttable.
diff --git a/test/hello/hello_v23_test.go b/test/hello/hello_v23_test.go
index 20fbeb5..622bb26 100644
--- a/test/hello/hello_v23_test.go
+++ b/test/hello/hello_v23_test.go
@@ -9,7 +9,7 @@
 	"os"
 	"time"
 
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/security"
 	_ "v.io/x/ref/runtime/factories/generic"
 	"v.io/x/ref/test/modules"
@@ -20,7 +20,7 @@
 //go:generate v23 test generate
 
 func init() {
-	envvar.ClearCredentials()
+	ref.EnvClearCredentials()
 }
 
 var opts = modules.StartOpts{
@@ -49,7 +49,7 @@
 		if err := idp.Bless(p, name); err != nil {
 			return nil, err
 		}
-		out[name] = fmt.Sprintf("%s=%s", envvar.Credentials, dir)
+		out[name] = fmt.Sprintf("%s=%s", ref.EnvCredentials, dir)
 	}
 	return out, nil
 }
diff --git a/test/modules/modules_test.go b/test/modules/modules_test.go
index badd777..d63e5c6 100644
--- a/test/modules/modules_test.go
+++ b/test/modules/modules_test.go
@@ -22,7 +22,7 @@
 
 	"v.io/v23"
 	"v.io/v23/verror"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/exec"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/test"
@@ -356,7 +356,7 @@
 		t.Fatalf("unexpected error: %s", err)
 	}
 	defer sh.Cleanup(os.Stdout, os.Stderr)
-	if got, want := getBlessing(t, sh, fmt.Sprintf("%s=%s", envvar.Credentials, creds)), noagent; got != want {
+	if got, want := getBlessing(t, sh, fmt.Sprintf("%s=%s", ref.EnvCredentials, creds)), noagent; got != want {
 		t.Errorf("Bad blessing. Got %q, want %q", got, want)
 	}
 }
diff --git a/test/modules/shell.go b/test/modules/shell.go
index d1c64b4..8858ebe 100644
--- a/test/modules/shell.go
+++ b/test/modules/shell.go
@@ -155,7 +155,7 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/security"
-	"v.io/x/ref/envvar"
+	"v.io/x/ref"
 	"v.io/x/ref/lib/exec"
 	"v.io/x/ref/services/agent/agentlib"
 	"v.io/x/ref/services/agent/keymgr"
@@ -733,8 +733,8 @@
 	// Clear any VeyronCredentials directory in m1 as we never
 	// want the child to directly use the directory specified
 	// by the shell's VeyronCredentials.
-	delete(m1, envvar.Credentials)
-	delete(m1, envvar.AgentEndpoint)
+	delete(m1, ref.EnvCredentials)
+	delete(m1, ref.EnvAgentEndpoint)
 
 	m2 := mergeMaps(m1, evmap)
 	r := []string{}
diff --git a/test/v23tests/v23tests.go b/test/v23tests/v23tests.go
index e792d08..4976dd1 100644
--- a/test/v23tests/v23tests.go
+++ b/test/v23tests/v23tests.go
@@ -19,12 +19,10 @@
 	"testing"
 	"time"
 
-	"v.io/x/lib/vlog"
-
 	"v.io/v23"
 	"v.io/v23/security"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/lib/vlog"
+	"v.io/x/ref"
 	"v.io/x/ref/services/agent/agentlib"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/modules"
@@ -362,7 +360,7 @@
 	}
 	// Set up agent for Child.
 	attr.Files = append(attr.Files, agentFile)
-	attr.Env = append(attr.Env, fmt.Sprintf("%s=%v", envvar.AgentEndpoint, agentlib.AgentEndpoint(len(attr.Files)-1)))
+	attr.Env = append(attr.Env, fmt.Sprintf("%s=%v", ref.EnvAgentEndpoint, agentlib.AgentEndpoint(len(attr.Files)-1)))
 
 	// Set up environment for Child.
 	for _, v := range t.shell.Env() {
@@ -633,13 +631,13 @@
 }
 
 // RunRootMT builds and runs a root mount table instance. It populates the
-// envvar.NamespacePrefix variable in the test environment so that all
+// ref.EnvNamespacePrefix variable in the test environment so that all
 // subsequent invocations will access this root mount table.
 func RunRootMT(i *T, args ...string) (*Binary, *Invocation) {
 	b := i.BuildV23Pkg("v.io/x/ref/services/mounttable/mounttabled")
 	inv := b.start(1, args...)
 	name := inv.ExpectVar("NAME")
-	inv.Environment().SetVar(envvar.NamespacePrefix, name)
+	inv.Environment().SetVar(ref.EnvNamespacePrefix, name)
 	vlog.Infof("Running root mount table: %q", name)
 	return b, inv
 }
diff --git a/test/v23tests/v23tests_test.go b/test/v23tests/v23tests_test.go
index 3315aa3..76e16be 100644
--- a/test/v23tests/v23tests_test.go
+++ b/test/v23tests/v23tests_test.go
@@ -16,12 +16,10 @@
 	"testing"
 	"time"
 
-	"v.io/x/lib/vlog"
-
 	"v.io/v23/naming"
 	"v.io/v23/security"
-
-	"v.io/x/ref/envvar"
+	"v.io/x/lib/vlog"
+	"v.io/x/ref"
 	_ "v.io/x/ref/runtime/factories/generic"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/modules"
@@ -54,7 +52,7 @@
 	proxyBin := env.BuildV23Pkg("v.io/x/ref/services/proxy/proxyd")
 	nsBin := env.BuildGoPkg("v.io/x/ref/cmd/namespace")
 
-	mt, ok := env.GetVar(envvar.NamespacePrefix)
+	mt, ok := env.GetVar(ref.EnvNamespacePrefix)
 	if !ok || len(mt) == 0 {
 		t.Fatalf("expected a mount table name")
 	}
@@ -296,7 +294,7 @@
 		msg := recover().(string)
 		// this, and the tests below are intended to ensure that line #s
 		// are captured and reported correctly.
-		if got, want := msg, "v23tests_test.go:306"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:304"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "fork/exec /bin/echox: no such file or directory"; !strings.Contains(got, want) {
@@ -318,7 +316,7 @@
 	sh.SetDefaultStartOpts(opts)
 	defer func() {
 		msg := recover().(string)
-		if got, want := msg, "v23tests_test.go:328"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:326"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "StartWithOpts"; !strings.Contains(got, want) {
@@ -342,7 +340,7 @@
 		if iterations == 0 {
 			t.Fatalf("our sleeper didn't get to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:349: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:347: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
@@ -364,7 +362,7 @@
 		if iterations != 0 {
 			t.Fatalf("our sleeper got to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:371: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:369: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()