recommended approach to generalising code with variables that must be assigned by the user

Or you can use Storage to store a config "file" on the device, that has the required credentials. That way you wouldn't have to put the credentials in code. Not even during development. Just read from flash. As long as the config is the same.
You would have to create a file on the device during development. And I think the custom loader could write that file as well when installing.