Secret and Config Management

What and Why

Secrets are credentials that authenticate your service to other systems: API keys, database passwords, TLS private keys, JWT signing keys, OAuth client secrets. Configuration is the settings that control your service's behavior: feature flags, timeouts, database hostnames, log levels.

You encounter config management every time you deploy to a new environment. You encounter secret management every time you need to rotate a credential, onboard a new service, or investigate an incident where a credential was exposed.

The distinction matters: config is not secret, but secrets are config. A database hostname is config — it belongs in a config file, an environment variable, or a config service. A database password is a secret — it belongs nowhere near your codebase or standard config files.

Why it matters:

• Leaked secrets are a direct path to data breaches and unauthorized access
• Misconfigured environments (wrong DB host, wrong timeout) cause outages
• Hardcoded config makes services unportable across environments
• Secret rotation without a management system causes downtime and ad-hoc coordination