diff --git a/cmd/dex/serve.go b/cmd/dex/serve.go
index 69ea7932..b3ccba92 100644
--- a/cmd/dex/serve.go
+++ b/cmd/dex/serve.go
@@ -7,6 +7,7 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"os"
 
 	"github.com/spf13/cobra"
 	"golang.org/x/net/context"
@@ -44,6 +45,7 @@ func serve(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFile, err)
 	}
+	configData = []byte(os.ExpandEnv(string(configData)))
 
 	var c Config
 	if err := yaml.Unmarshal(configData, &c); err != nil {
diff --git a/connector/github/github.go b/connector/github/github.go
index b679e0ed..988c2c53 100644
--- a/connector/github/github.go
+++ b/connector/github/github.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	"net/http"
-	"os"
 	"strconv"
 
 	"golang.org/x/net/context"
@@ -32,8 +31,8 @@ func (c *Config) Open() (connector.Connector, error) {
 		redirectURI: c.RedirectURI,
 		org:         c.Org,
 		oauth2Config: &oauth2.Config{
-			ClientID:     os.ExpandEnv(c.ClientID),
-			ClientSecret: os.ExpandEnv(c.ClientSecret),
+			ClientID:     c.ClientID,
+			ClientSecret: c.ClientSecret,
 			Endpoint:     github.Endpoint,
 			Scopes: []string{
 				"user:email", // View user's email
diff --git a/connector/oidc/oidc.go b/connector/oidc/oidc.go
index 6f19b7d4..e2d3361b 100644
--- a/connector/oidc/oidc.go
+++ b/connector/oidc/oidc.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"os"
 
 	"github.com/ericchiang/oidc"
 	"golang.org/x/net/context"
@@ -42,12 +41,12 @@ func (c *Config) Open() (conn connector.Connector, err error) {
 		scopes = append(scopes, "profile", "email")
 	}
 
-	clientID := os.ExpandEnv(c.ClientID)
+	clientID := c.ClientID
 	return &oidcConnector{
 		redirectURI: c.RedirectURI,
 		oauth2Config: &oauth2.Config{
 			ClientID:     clientID,
-			ClientSecret: os.ExpandEnv(c.ClientSecret),
+			ClientSecret: c.ClientSecret,
 			Endpoint:     provider.Endpoint(),
 			Scopes:       scopes,
 			RedirectURL:  c.RedirectURI,
diff --git a/examples/config-dev.yaml b/examples/config-dev.yaml
index 5f937da4..9f2885f0 100644
--- a/examples/config-dev.yaml
+++ b/examples/config-dev.yaml
@@ -37,6 +37,15 @@ connectors:
 - type: mockCallback
   id: mock
   name: Example
+# - type: oidc
+#   id: google
+#   name: Google
+#   config:
+#     issuer: https://accounts.google.com
+#     #  Config values starting with a "$" will read from the environment.
+#     clientID: $GOOGLE_CLIENT_ID
+#     clientSecret: $GOOGLE_CLIENT_SECRET
+#     redirectURI: http://127.0.0.1:5556/dex/callback/google
 
 # Let dex keep a list of passwords which can be used to login the user
 enablePasswordDB: true