Where should I store passwords, API tokens and other server secrets?
Use an approved secrets-management approach suited to the application and operating system. Keep secret values out of source code, public files, ordinary tickets and command-line arguments. The application should receive only the secrets it needs, through a protected supported mechanism.
Before you start
- An inventory of secret owners, consumers and the platform’s supported credential mechanisms.
Instructions
1. Classify and minimise access
Identify database credentials, API tokens, SSH keys, certificate keys and deployment secrets. Record their purpose, owner, scope and expiry without storing values in the inventory. Prefer narrowly scoped credentials and supported short-lived identities when practical, rather than one shared token for every environment.
2. Choose a protected delivery method
Use a dedicated secret store or properly protected application mechanism with access logging. Restrict configuration files and avoid placing them in web-served directories or container image layers. Environment variables are not automatically private; administrators, diagnostics and process tooling can expose them in some environments.
3. Plan rotation and revocation
Define how a new credential reaches every consumer and how service health is checked before retiring the previous one. Protect emergency retrieval and document what happens after suspected exposure. Scan approved repositories and artifacts for accidental secrets, and revoke an exposed credential rather than merely deleting the visible copy.
Check the result
- Only the intended identities can retrieve the required secrets.
- A tested rotation preserves application function and makes the old credential unusable when retired.
Troubleshooting
- A token was committed to a repository
- Treat it as exposed, revoke or rotate it through the issuer and inspect its usage. Removing the latest file does not remove copies from history or external clones.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.