# How do you manage config files containing secrets like passwords and API keys?

**URL:** <https://erlangforums.com/t/how-do-you-manage-config-files-containing-secrets-like-passwords-and-api-keys/2769>\
**Category:** Chat / Discussions\
**Tags:** configuration\
**Created:** [July 28, 2023, 3:08pm UTC](https://erlangforums.com/t/how-do-you-manage-config-files-containing-secrets-like-passwords-and-api-keys/2769 "2023-07-28T15:08:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![unix1](https://erlangforums.com/letter_avatar_proxy/v4/letter/u/9d8465/32.png) [@unix1](https://erlangforums.com/u/unix1)\
**Post date:** [July 28, 2023, 3:08pm UTC](https://erlangforums.com/t/how-do-you-manage-config-files-containing-secrets-like-passwords-and-api-keys/2769/1 "2023-07-28T15:08:50Z")

</div>

I’m curious how you handle secrets in your production Erlang/OTP application configuration. I do see this [other thread](https://erlangforums.com/t/configuration-of-erlang-system/432) about the configs in general, but I’m more curious about the secrets here. I would also like to know what libraries/dependencies/services/tools you use, especially if you pick one of the latter options, if you’re willing and able to share. Finally, feel free to share recommended best practices and associated tools in the comments too, even if you don’t currently follow them, but perhaps wish you did.

_Poll ([view on site](https://erlangforums.com/t/how-do-you-manage-config-files-containing-secrets-like-passwords-and-api-keys/2769/1))_

---

<div class="post-metadata">

**Author:** ![rkallos](https://erlangforums.com/letter_avatar_proxy/v4/letter/r/c77e96/32.png) [@rkallos](https://erlangforums.com/u/rkallos)\
**Post date:** [August 3, 2023, 7:40pm UTC](https://erlangforums.com/t/how-do-you-manage-config-files-containing-secrets-like-passwords-and-api-keys/2769/2 "2023-08-03T19:40:09Z")

</div>

At various points, I’ve handled secrets in the following ways:

- Retrieving from Hashicorp Vault, using a library I wrote: [GitHub - rkallos/canal: HashiCorp Vault client written in Erlang](https://github.com/rkallos/canal). This was written at a previous job, and I haven’t really maintained it since. On the bright side, Vault was easy to work with, and it replaced N secrets with 1 secret (the credentials to retrieve secrets from Vault)
- Generating a config file at release time that exists in plain-text on the server. Usually this config file would be a shell script that exports environment variables containing the secrets, and the Erlang application is started with those environment variables. It works well for secrets that rarely change.
- Environment variables are created via orchestration software (e.g. k8s). What’s nice about this is that the secrets can be stored somewhere like AWS Secrets Manager, and the Erlang application doesn’t need to care; since it’s the orchestrator’s responsibility to fetch and provide the secrets. However, the use of environment variables means that pods ought to be restarted when the secret values change, which can be cumbersome for stateful applications.