What Is Secrets Management?

Secrets management is how you store, distribute, rotate, and audit the credentials that applications and infrastructure use: API keys, database passwords, tokens, and certificates. These are non-human identity credentials, and leaked ones are a leading cause of cloud breaches.

The problem

Secrets end up hardcoded in source, baked into images, and pasted into config. Once leaked, many stay valid for a long time. Industry research finds millions of secrets exposed in public code each year, and a large share remain active.

What good looks like

• Central vault instead of secrets scattered across repos and pipelines.
• Dynamic, short-lived secrets issued on demand rather than long-lived static keys.
• Automated rotation so exposure windows stay small.
• Detection of secrets that leak into code and logs.
• Audit of who and what accessed each secret.

Related disciplines

Secrets management overlaps with PAM for privileged credentials, PKI for certificates, and broader non-human identity governance.

The measure that matters

The useful metric is not how many secrets are in the vault. It is how many exist outside it. A vault full of static database passwords improves auditability and changes very little about blast radius; generating a 15-minute credential on demand removes the asset entirely.

That is why the maturity order is: get secrets out of source and configuration, into a vault, then replace vaulted static secrets with dynamic ones, then replace dynamic secrets with platform-attested workload identity wherever the runtime can vouch for the caller.

Why teams do not rotate

Ask why a credential has not been rotated in three years and the answer is almost never policy. It is that nobody is certain what breaks. That uncertainty is itself the finding: it means the secret has been copied rather than referenced, and its consumers are unknown.

Fixing that (single source of truth, references instead of copies, a tested rotation runbook) matters more than the interval you choose. See secrets rotation.

Automation platforms are credential concentrators

A category worth calling out specifically. Workflow and automation tools exist to hold connections to databases, repositories, cloud accounts, AI services, and support platforms, which makes a single token for the orchestrator worth more than any credential it stores.

GitGuardian demonstrated the consequence in August 2026: with a leaked n8n API token, an attacker does not need to read a stored secret, because they can build a workflow that uses the credential to call their own endpoint. Read-only access to a workflow engine is not read-only in effect. The same reasoning applies to CI systems and to MCP servers brokering agent access.

Where to start

Where to start

Browse secrets management vendors and the machine identity vendors, and read the API key rotation guide.