What is secrets management?
Secrets management is the discipline of controlling the credentials software uses to reach other systems: API keys, database passwords, access tokens, certificates, and encryption keys. The secrets live in a dedicated vault that encrypts them, limits which application or person may read each one, and logs every read. Applications fetch what they need at run time instead of carrying secrets in source code or configuration files. Mature setups issue credentials that expire within hours and rotate long-lived keys on a schedule or immediately after a suspected leak.
Why secrets management matters
AI platforms hold many such secrets, because each agent connector to an ERP, CRM, ticketing system, or mailbox needs one. They also add a new way to leak them. Anything placed in a prompt can reappear in a model’s output or in conversation logs, and a prompt injection can ask for it directly. The safer design keeps credentials out of the model’s view entirely: the model requests a tool call, and the platform attaches the key when it makes that call.
Secrets management in practice
A freight brokerage runs an agent that checks carrier rates through partner APIs and books shipments in its transportation management system. The agent’s configuration contains no keys. For each tool call, the platform reads the key from the vault, attaches it to the outbound request, and logs the access. When a developer with vault access leaves, the team rotates the carrier keys in the vault, and the agent keeps running without a configuration change.