Secret (Credential)

What Is a Secret (Credential)?

A secret, or credential, is any sensitive value a machine uses to authenticate. Where a human enters a password to log in, a service or AI agent presents a secret to gain programmatic access to an API, database, cloud resource or another microservice.

Common credential types include:

• API keys: Static tokens that authorize a calling application to an application programming interface (API)
• OAuth tokens: Short- or long-lived tokens issued by an authorization server
• SSH keys: Asymmetric key pairs for Secure Shell (SSH) access to servers and pipelines
• Database credentials: Connection strings or username/password pairs in application configuration
• TLS/SSL certificates: Cryptographic certificates for Transport Layer Security (TLS) authentication
• Encryption and signing keys: Keys used to encrypt data or sign software artifacts

The National Institute of Standards and Technology (NIST) SP 800-63-4 defines an authentication secret as “a generic term for any secret value that is used to verify the subscriber in an authentication protocol,” splitting them into short-term secrets (limited attack window) and long-term secrets (valid until manually reset).

How Are Secrets Different From Passwords?

Passwords authenticate humans. Secrets authenticate machines. The distinction matters operationally because secrets are frequently:

• Issued programmatically, often without human involvement
• Used by multiple services or pipelines, rather than one person
• Too numerous to rotate manually at scale

This means the same hygiene rules that apply to user passwords (uniqueness, rotation, revocation) apply to secrets, but they must be enforced through automation rather than policy reminders.

What Is the Secrets Sprawl Problem?

Secrets sprawl when credentials multiply across codebases, configuration files, continuous integration/continuous delivery (CI/CD) pipelines, collaboration tools, and container images without centralized tracking or lifecycle management.

According to the GitGuardian State of Secrets Sprawl 2025 report, 23.8 million secrets were leaked in public GitHub repositories in 2024 (a 25% year-over-year increase), and 70% of secrets exposed in 2022 remained valid through 2024.

The Open Worldwide Application Security Project (OWASP) NHI Top 10 lists Secret Leakage as NHI2:2025, noting that 37% of organizations store secrets in environment variables or hardcode them directly in application source code.

AI coding assistants compound the problem: the GitGuardian report found that repositories using GitHub Copilot showed a 6.4% secret leakage rate, 40% higher than the public repository average.

Long-Lived vs. Short-Lived Secrets

The most impactful shift in secrets hygiene is moving from long-lived, static credentials to short-lived ones that expire automatically. The table below compares common secret and credential types:

OWASP NHI7:2025 flags long-lived secrets as a standalone top 10 risk, noting that 80% of organizations have key management system rotation disabled and 51% lack formal API key revocation processes.

“AI agents can do a lot of damage very quickly. And so it’s really important that you just don’t leave tokens or passwords out to have access for a long period of time, because an agent only needs a minute or two to export a ton of data or to do something really bad.” Micah Spady, Director of Product Marketing at SecureW2

Secrets in AI Agent Deployments

AI agents introduce a new dimension to secrets management. An agent may call dozens of external APIs, read from databases, and spawn sub-agents — each interaction requiring a credential. A single compromised secret can propagate access far beyond the original task scope.

Three practices contain that risk:

1. Unique credentials per agent: Each agent gets its own secret, so revoking one does not disrupt others.
2. Just-in-time retrieval: Agents fetch secrets from a vault at runtime, hold them in memory only for the task duration and never write them to logs.
3. Scoped access: Secrets carry only the permissions the current task requires, not the full permission set of the user or system that launched the agent.

Agent credential provisioning formalizes these steps into a lifecycle: issue, use, expire and audit.

How Should Secrets Be Managed?

Secrets are only secure if they remain confidential.

Secrets should be managed through a centralized lifecycle instead of stored directly. Effective secrets management typically includes:

• Centralized storage: Store secrets in a dedicated secrets manager or vault rather than hardcoding them.
• Automated provisioning: Issue just-in-time credentials when a workload or AI agent needs access, rather than distributing static credentials.
• Least-privilege access: Limit each secret to the resources and actions required for its specific workload or task.
• Short lifetimes: Use credentials that expire automatically. Short-lived credentials reduce the amount of time an attacker can exploit a stolen secret.
• Revocation: Immediately invalidate credentials that are compromised or associated with a decommissioned workload.
• Monitoring and auditing: Track credential issuance and use so security teams can detect unusual access patterns and investigate potential compromise.

For AI agents and other non-human identities, these controls become more difficult to manage as the number of agents and credentials increase.

Automated identity systems can reduce the need for long-lived secrets by issuing short-lived cryptographic credentials to authenticated workloads.

The goal of effective secrets or credential management is to minimize how many secrets exist, how long they remain valid, where they can be used and what an attacker can access if one is compromised.

Related Terms

Frequently Asked Questions