We actually support that exact use case natively. Each Doppler project has the concept of root and branch configs where branch configs inherit their secrets from the root. There is a root config for each environment (dev, stg, prd). More here: https://docs.doppler.com/docs/enclave-config-branching

In your specific case I would recommend creating a Doppler project for each app. Then you can add the common secrets to the "prd" root config. From there create branch configs for each locations:

prd (holds common secrets)

- prd_us_east_1 (inherits secrets from root plus hold us_east_1 specific vars)

- prd_us_central_1 (inherits secrets from root plus hold us_central_1 specific vars)

When you need to add/modify/delete a secret for all production configs, just modify the "prd" config.