{"id":"agent-secrets","slug":"agent-secrets","name":"Agent secrets & non-human credentials","shortName":"Agent secrets & non-human credentials","problemStatement":"Store and inject API keys for agents without leaking long-lived secrets into prompts, logs, or sandboxes.","whenNotTopPick":"Want seat-priced SaaS DX + free agent identities — Doppler; already standardized on 1Password Business — onepassword-secrets; HashiCorp estate / dynamic creds — hashicorp-vault; pure AWS IAM world — aws-secrets-manager.","categoryIds":["cat-auth-payments"],"depotPickProviderId":"infisical","depotPickRationale":"privacy + dx + lockInRisk. Infisical wins on Agent Proxy + MIT self-host; Doppler wins pure DX.","runnersUpIds":["doppler","onepassword-secrets","hashicorp-vault","aws-secrets-manager"],"weights":{"capabilityFit":0.25,"pricePerformance":0.18,"latencyReliability":0.15,"developerDx":0.15,"privacyPosture":0.1,"lockInRisk":0.07,"maturity":0.1},"methodologyNotes":"privacy + dx + lockInRisk. Infisical wins on Agent Proxy + MIT self-host; Doppler wins pure DX.","tags":["agent"],"depth":{"whenNotToUse":{"text":"Want seat-priced SaaS DX + free agent identities — Doppler; already standardized on 1Password Business — onepassword-secrets; HashiCorp estate / dynamic creds — hashicorp-vault; pure AWS IAM world — aws-secrets-manager.","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"doppler","name":"Doppler","overallForJob":8.47,"pickOverallForJob":8.36,"beatsPickOn":["pricePerformance","latencyReliability","developerDx","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":3.5,"runnerUpLockInRisk":5,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":["self-hostable (provider tag `self-host`)","open source (provider tag `oss`)"],"runnerUpExitSignals":[],"pickNotes":[{"text":"MIT-licensed self-host + strong agent/machine identity story","field":"strengths"},{"text":"Strengths: MIT-licensed self-host + strong agent/machine identity story;","field":"description"}],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up Doppler (3.5 vs 5). Pick exit signals: self-hostable (provider tag `self-host`); open source (provider tag `oss`).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":2,"sourcesReachable":2,"pricingRows":5,"pricingRowsReconfirmed":1,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}}},"depotPick":{"id":"infisical","slug":"infisical","name":"Infisical","tagline":"Depot default for agent secrets when you want OSS exit + Agent Proxy (placeholders instead of raw keys in the…","overall":8.36},"runnersUp":[{"id":"doppler","slug":"doppler","name":"Doppler","tagline":"Best secrets DX for most startups. Prefer Infisical when you need self-host or Agent Proxy that never hands…","overall":8.47},{"id":"onepassword-secrets","slug":"onepassword-secrets","name":"1Password Secrets Automation","tagline":"Use when the company already lives in 1Password Business. Don't buy 1Password just for agents — pick…","overall":7.98},{"id":"hashicorp-vault","slug":"hashicorp-vault","name":"HashiCorp Vault (HCP)","tagline":"Runner-up for agent secrets when HashiCorp is already the standard. Infisical remains the depot default for…","overall":8.1},{"id":"aws-secrets-manager","slug":"aws-secrets-manager","name":"AWS Secrets Manager","tagline":"Default only if the agent already runs inside AWS with IAM roles. Otherwise Doppler/Infisical.","overall":7.69}]}