Stop handing the agent your .env — broker short-lived secrets through a vault instead

Asked (summary):

Our dev agents (OpenCode scripts and plugins) read tokens and passwords from environment variables, which any Windows process can read. What is the best-practice, easy-to-use secret manager for scripts, plugins, and agents?

This report compares 8 vault and CLI interfaces documented across 5 official-documentation hosts (1Password, Doppler, Infisical, HashiCorp, Microsoft; 294 documentation pages scanned), on how each stores secrets, authenticates unattended automation, and — critically — in what form plaintext reaches the running process.

Pick a lane: eight options, grouped by what they are best at

Operational complexity rises left to right. Colour shows how plaintext reaches the process at execution time — none of these makes a delivered secret unreadable to an equally privileged process, so pair any of them with a low-privilege agent account and brokered tools.

environment variables command output file on disk recommended lane for an Azure/Windows org

Hover or tap an option to see its storage, unattended auth, and script integration here.

What the comparison cannot say in one picture

Rollout in five moves

Stop launching OpenCode with the full .env; split identities per tool, project, and environment, and make production access read-only or approval-gated.
Prefer workload identity: on Azure, a VM's system-assigned managed identity authenticates to Key Vault with no stored credential at all.
Centralise unavoidable static secrets in one vault with audit logs and rotation; expose each secret only to a small approved wrapper at execution time.
Give the model brokered tools — deploy(target), query_database(read_only_query) — never get_secret(name); trusted code uses the secret internally and returns sanitised results.
Run unattended agents under a dedicated low-privilege Windows account or a disposable VM/container; keep any local bootstrap credential in DPAPI-protected SecretStore with strict ACLs.

The eight options, row by row

Option	Script integration	Unattended auth	Plaintext reaches process as	Doc pages	Source

Comparison of 8 secret-management products and interfaces, one row each, extracted from official documentation on 5 hosts (294 pages scanned) during this research. “Doc pages” counts documentation pages found in the extraction, a rough proxy for surface area and operational complexity, not quality. Full storage and exposure descriptions are shortened in the lane board; exact wording appears in the detail panel and table. Each row links its documentation source.

This report was generated automatically by Keenable SELECT at a user's request, from publicly available web sources linked herein. Keenable does not review, verify, or endorse its contents and makes no representation as to accuracy, completeness, or timeliness; AI-based extraction may contain errors. Nothing in this report is investment, legal, financial, or other professional advice. All trademarks and referenced content remain the property of their respective owners; no affiliation or endorsement is implied. To report an error, rights concern, or request removal: legal@keenable.ai.