Secrets management
How API keys, passwords and signing keys are stored, shared, rotated and kept out of code, logs and the apps people install.
Updated October 2026 · with examples from our own builds
What does secrets management mean in practice?
Every product depends on secrets: payment keys, AI provider keys, database passwords and signing keys. Managing them means keeping them out of the codebase, giving each environment its own, limiting who can read them and having a plan to rotate any that leak.
Secrets are part of what you own and must be able to hand over, and they leak in mundane ways: pasted into the wrong config field, shipped inside a mobile app bundle, or copied twice into a settings file where only one copy is read.
Products that store their customers' secrets, such as mailbox passwords or API keys, need a vault: encryption bound to the customer, a logged retrieval path and nothing returned to the browser.
Secrets management at a glance
- Never put secrets in
- Code, mobile app bundles or logs
- Per environment
- Separate keys for test and live
- Hand over
- Every key, who holds it and how to rotate it
Where has secrets management come up in our builds?
Before switching to live payments we checked the shape of every key and caught a Stripe secret key pasted into the Google Places key field; shipped, it would have been readable inside every installed copy of the app. The handover included environment templates for all four repositories.
Every credential goes through one SecretVault: a fresh data key per secret, AES-256-GCM with the workspace ID bound in, the data key wrapped by a key derived from a master secret held only in the server environment, and an audit-log entry on every retrieval.
At our last record the visiting-card reader in production was waiting for the firm's own AI API key; until it lands, cards are kept and the panel says they are waiting to be read rather than claiming they were.
Common questions about secrets management
Can API keys be stored inside a mobile app?
Only keys designed to be public, such as restricted maps keys. Anything secret in an app bundle can be extracted from every installed copy, so secret keys must stay on the server.
Who should hold my product's keys?
Your company, in accounts it owns, with a written list of every key, where it is used and how to rotate it. Developers get access through those accounts, not through copies on their laptops.
Related terms
Sources
Planning a product and not sure where secrets management fits? Ask us, or browse all 116 terms in the glossary.