# What is Secrets Management?

> Secrets management is the controlled lifecycle for sensitive values that systems use to authenticate, authorize actions, establish trust, or protect data.

- Canonical URL: https://yellowcube.eu/glossary/secrets-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Examples include API keys, database credentials, private keys, signing keys, access tokens, and other bearer credentials. The practice covers secure generation, storage, distribution, use, rotation or renewal, revocation, expiration, recovery, and destruction — not merely placing values in an encrypted repository.

Effective designs minimize who and what can retrieve each secret, prefer short-lived or dynamically issued credentials where practical, and prevent values from appearing in source code, build output, logs, or support channels. Ownership, purpose, consumers, and dependencies should be recorded so a secret can be changed quickly without leaving old copies active or causing an uncontrolled outage.

### Key points

- **Lifecycle controls:** Generate with suitable strength, provision over protected paths, scope access, set an appropriate lifetime, rotate safely, revoke promptly, and remove obsolete copies.
- **Operational controls:** Authenticate workloads strongly, separate environments, audit access and administration, detect exposure, test emergency recovery, and rehearse compromise response.
- **Design preference:** Reduce shared and long-lived secrets. Where supported, use workload identity and narrowly scoped temporary credentials rather than distributing reusable static values.
- **Important limitation:** A secrets manager becomes a high-value dependency and does not prevent an authorized or compromised workload from reading a secret. Access policy, endpoint security, availability, and the initial trust path still matter.

### Related terms

[Login credentials](<https://yellowcube.eu/glossary/login-credentials/>) · [Cryptographic key management](<https://yellowcube.eu/glossary/cryptographic-key-management/>) · [Non-human identity (NHI)](<https://yellowcube.eu/glossary/non-human-identity/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [Certificate management](<https://yellowcube.eu/glossary/certificate-management/>)

### Sources

[OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) · [NIST Key Management FAQ](https://csrc.nist.gov/Projects/Key-Management/faqs)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.