Secrets Management
The practice and tooling for safely storing, distributing, accessing, and auditing application secrets like API keys, database passwords, and tokens.
Also known as: Secret Management, Credential Management, Application Secrets Management
Category: Software Development
Tags: security, best-practices, software-engineering, technologies, operations, access-control
Explanation
Secrets management is the discipline of handling the sensitive credentials that applications and services need to operate — API keys, database passwords, OAuth client secrets, TLS private keys, signing keys, and similar — across their entire lifecycle. The goal is to give every workload exactly the credentials it needs, exactly when it needs them, with full auditability, while ensuring that no secret ends up in source code, container images, CI logs, chat messages, or developer laptops. In modern distributed systems with hundreds of services and thousands of secrets, this is a problem of scale, not just security.
The core anti-pattern that secrets management exists to eliminate is hardcoding credentials in source code, config files, or environment variables baked into images. Even with private repositories and access controls, this approach leaks. A repository becomes public. An old backup is exposed. A misconfigured logger writes the environment to disk. A leaked laptop has the credentials too. Centralizing secrets so that the actual value lives in one auditable place — not scattered across deployment artifacts — dramatically reduces these risks.
Dedicated secrets managers like HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, Azure Key Vault, Doppler, and 1Password Secrets Automation provide encrypted storage, fine-grained access policies, automatic rotation, and detailed audit logs. Applications fetch secrets at startup or on demand using short-lived tokens issued by an identity layer (machine identity, IAM role, service account). Some platforms support dynamic secrets: the manager generates a fresh, time-limited database credential or cloud token for each request, eliminating long-lived shared secrets entirely.
Good secrets management practices include: never committing secrets to source control (enforced by pre-commit hooks, CI scanners, and platform-level secret scanning); injecting secrets at runtime rather than build time; using short-lived credentials wherever possible; scoping each secret to the minimum set of services that need it; logging every access for forensic review; and rotating regularly. Secret-scanning tools like git-secrets, TruffleHog, GitHub Secret Scanning, and GitGuardian help catch leaks in the development pipeline; the same scanning runs in reverse on public repositories to detect and revoke real credentials within minutes.
Secrets management is the operational layer atop key management. Where key management focuses on cryptographic keys and the rules for handling them, secrets management is broader and more application-centric: any credential, any service, any environment. The two disciplines blur together in modern platforms — the same KMS often backs both — but the framing is useful. The practical north star is the same: secrets should be many, small, short-lived, and never seen by humans except when explicitly broken-glass-required.
Related Concepts
← Back to all concepts