In Azure, prefer managed identity so the application can access Key Vault without storing a client secret. Grant the identity only the specific data-plane permissions it needs and use DefaultAzureCredential. Example: var client = new SecretClient(new Uri(vaultUri), new DefaultAzureCredential()); KeyVaultSecret secret = await client.GetSecretAsync("PaymentApiKey", cancellationToken: ct); Use configuration providers and cache secrets for an appropriate period rather than calling the vault on every request. Separate vaults/identities by environment, enable audit logs, rotation, soft delete, and purge protection. Never commit secrets, place them in images, expose them to the browser, or print them in logs and exceptions.
Backbencher Developer · · 0 likes