{"id":"agent-secrets","slug":"agent-secrets","name":"Agent secrets & non-human credentials","shortName":"Agent secrets & non-human credentials","problemStatement":"Store and inject API keys for agents without leaking long-lived secrets into prompts, logs, or sandboxes.","whenNotTopPick":"Want seat-priced SaaS DX + free agent identities — Doppler; already standardized on 1Password Business — onepassword-secrets; HashiCorp estate / dynamic creds — hashicorp-vault; pure AWS IAM world — aws-secrets-manager.","categoryIds":["cat-auth-payments"],"depotPickProviderId":"infisical","depotPickRationale":"privacy + dx + lockInRisk. Infisical wins on Agent Proxy + MIT self-host; Doppler wins pure DX.","runnersUpIds":["doppler","onepassword-secrets","hashicorp-vault","aws-secrets-manager"],"weights":{"capabilityFit":0.25,"pricePerformance":0.18,"latencyReliability":0.15,"developerDx":0.15,"privacyPosture":0.1,"lockInRisk":0.07,"maturity":0.1},"methodologyNotes":"privacy + dx + lockInRisk. Infisical wins on Agent Proxy + MIT self-host; Doppler wins pure DX.","tags":["agent"],"depth":{"whenNotToUse":{"text":"Want seat-priced SaaS DX + free agent identities — Doppler; already standardized on 1Password Business — onepassword-secrets; HashiCorp estate / dynamic creds — hashicorp-vault; pure AWS IAM world — aws-secrets-manager.","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"doppler","name":"Doppler","overallForJob":8.47,"pickOverallForJob":8.36,"beatsPickOn":["pricePerformance","latencyReliability","developerDx","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":3.5,"runnerUpLockInRisk":5,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":["self-hostable (provider tag `self-host`)","open source (provider tag `oss`)"],"runnerUpExitSignals":[],"pickNotes":[{"text":"MIT-licensed self-host + strong agent/machine identity story","field":"strengths"},{"text":"Strengths: MIT-licensed self-host + strong agent/machine identity story;","field":"description"}],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up Doppler (3.5 vs 5). Pick exit signals: self-hostable (provider tag `self-host`); open source (provider tag `oss`).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":2,"sourcesReachable":2,"pricingRows":5,"pricingRowsReconfirmed":1,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}}}}