Secrets management is the safe storage and handing out of the passwords, API keys and certificates that programs use to log in to other programs. These credentials are called secrets. Secrets management keeps them in a vault, so that they are not written inside the code or in configuration files.
A modern app is made of many programs that call one another. The ordering program logs in to the database. The payment program calls a payment gateway with an API key, which is a long password that identifies one program to another. Each of these logins needs a secret. Developers often paste the secret into the code, because that is the quickest way to make it work. But when the code is copied to a shared repository or a public site, the secret goes with it. Attackers search public code for such hard-coded secrets all the time. Tools such as static application security testing (SAST) look for secrets in the code before it is released.
With secrets management, the code contains no secret. When the program starts, it proves its own identity to the vault, for example with the identity of the cloud server that it runs on. The vault checks that this program is allowed to have the secret, and hands it over. The vault logs every request.
The strongest form is the dynamic secret, which the vault creates fresh for each program and deletes soon after. Here is a typical case. An online grocery company in Kolkata runs its delivery-slot program on cloud servers. At 6:00 a.m., the program starts and asks the vault for access to the orders database. The vault creates a new database user with a random password. This user can only read and change the table of delivery slots, and it expires after one hour. The program connects with it. At 7:00 a.m., the vault deletes that user, and the program asks for a new one. If an attacker copies the password at 6:30, it stays valid for half an hour at most, and only on one table.
Secrets belong to non-human identities, the accounts of programs. In most companies, these outnumber employees' accounts many times over. Secrets management is often sold as part of privileged access management (PAM), because both keep powerful credentials in a vault. Cloud workload protection (CWPP) can spot a running program that holds a secret it should not have. Certificate lifecycle management supplies the certificates that the vault hands to programs.