I'm curious how other developers manage API keys, access tokens, passwords, and similar secrets for personal projects and web applications. I've mostly used a plain text note so far, but I'm wondering what safer and more practical approaches people use for local development, deployments, and production systems.
4 Answers
The general rule is to choose based on the environment: password managers for human credentials, encrypted local configuration for development, and a proper secret store for production. Avoid putting secrets in plain text notes, hardcoding them, or sending them to an AI service. Also make sure logs, backups, build artifacts, and Git history cannot accidentally contain them.
For deployed applications, use a dedicated secrets manager rather than keeping credentials in the repository. Cloud options like AWS Systems Manager, Google Secret Manager, and Azure Key Vault work well, while Vault or OpenBao are useful for self-managed environments. Secrets should be injected at runtime with appropriate access controls and rotation.
For solo projects, a password manager such as Bitwarden, 1Password, or KeePassXC is a solid source of truth. Locally, a gitignored `.env` file can be convenient, as long as it never gets committed and access is limited to your machine. The biggest danger is usually accidentally exposing a secret in Git history or application logs.
In Kubernetes, a common setup is storing secrets in Vault or a cloud secret manager and syncing them into workloads with an External Secrets operator. For infrastructure repositories, SOPS or Ansible Vault can encrypt values while keeping the encrypted configuration portable. The decryption keys still need to be protected separately.
That makes sense. My main concern was finding something that works both for local development and for deployments without copying secrets around manually.
Yes, it was a serious question—I’m trying to replace my current plain text workflow with something safer.