---
title: "Keep secrets in a secrets store · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep secrets in a secrets store

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production)
- Rule: Keep passwords, keys and tokens in a secrets manager or the platform's encrypted store. Give them to the app when it starts, and rotate them on a schedule.
- How: Use a store such as HashiCorp Vault, AWS Secrets Manager or your host's encrypted settings. On a single server, a root-only file or systemd credentials will do. Give each secret an owner and a rotation date at most 90 days ahead, and rotate at once after a leak. Automate it where the store can, as [rotate secrets automatically](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/automatic-secret-rotation) says. See [secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code) for keeping them out of the repository. See also [let CI sign in with OIDC](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci) and [keep secrets out of state](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secrets-out-of-state).
- Check: A secret scanner finds no secret in the repository or the build output. Every secret in the store shows an owner and a rotation date that has not passed.

Example:

```ini
# systemd: the secret reaches the service as a file, never in its environment listing
[Service]
LoadCredential=db-password:/etc/shop/db-password
```

```js
// Node.js: systemd puts each credential in a private folder
import { readFileSync } from 'node:fs';
import path from 'node:path';

const dbPassword = readFileSync(path.join(process.env.CREDENTIALS_DIRECTORY, 'db-password'), 'utf8').trim();
```

```python
from pathlib import Path
import os

db_password = (Path(os.environ["CREDENTIALS_DIRECTORY"]) / "db-password").read_text().strip()
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers engineering playbook: https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store`.

- Previous: [Separate deploying from releasing](https://agentwranglers.se/playbook/engineering/running-in-production/deploy-is-not-release)
- [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production)