---
title: "Use SOPS for secrets · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/secrets-manager-or-sops
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use SOPS for secrets

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/stack/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)
- Rule: Keep runtime secrets in the repository encrypted with SOPS, and decrypt them only on the server or in CI.
- Cost: Open source. SOPS is MPL-2.0. A cloud secrets manager is paid per secret and per request.
- How: SOPS started at Mozilla, with 1.0 in November 2015, and is now a CNCF project under MPL-2.0. Version 3.13.3 shipped on 23 July 2026. It encrypts only the values in YAML, JSON or env files, with age keys or a cloud key service. Secrets then move with the code, and Git history shows who changed which key. A paid cloud secrets manager, such as AWS Secrets Manager since April 2018, adds rotation and audit logs. Use one when your whole app already runs in that cloud. Follow [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store) for how to run it. Choose something else when you need dynamic database credentials on your own servers. Then use OpenBao, the MPL-2.0 fork of Vault, at 2.7.1 since 1 October 2026.
- Check: A secret scanner such as TruffleHog or gitleaks finds zero plain-text secrets in the full Git history. Every secret file in the repository opens only with `sops --decrypt`.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
# .sops.yaml
creation_rules:
  - path_regex: secrets/.*\.yaml$
    age: age1examplepublickeyexamplepublickeyexamplepublickeyexample
```

### Shell example

```sh
sops --encrypt --in-place secrets/production.yaml
sops exec-env secrets/production.yaml './server'
```

## Sources

- [SOPS](https://getsops.io/)
- [OpenBao](https://openbao.org/)

## Related rules

- [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/secrets-manager-or-sops">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Use a managed DNS and CDN that exports your zone](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/managed-dns-and-cdn)
- Next: [Use Trivy to scan images and dependencies](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy)
- [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)