What is secrets management?
Secrets management is the practice of storing, distributing and rotating the credentials an application needs — API keys, database passwords, tokens, certificates — without those secrets ending up in source code, config files, chat logs or an AI agent's context window. The failure it exists to prevent is "secret sprawl": the same key copied into a dozen .env files, CI configs and messages, none of which anyone can revoke cleanly.
What a secrets manager does
| Capability | Why it matters |
|---|---|
| Central store | One place to update or revoke a credential |
| Injection at runtime | The app reads the secret from the manager, not from a file on disk |
| Rotation | Credentials change on a schedule; a leaked one has a short shelf life |
| Dynamic secrets | A short-lived credential minted per session that expires on its own |
| Audit log | Who read which secret, and when |
The AI-agent angle
An autonomous agent that calls authenticated APIs is a new place for secrets to leak: anything in its context can be pulled out by prompt injection. The mitigation is to never give the agent the real key — a broker or proxy injects it into the outbound request after the agent has handed over a placeholder. Infisical's Agent Proxy and HashiCorp Vault both work this way.
Tools: HashiCorp Vault, Infisical, the AWS / GCP / Azure secret managers, 1Password, Doppler.