Whether you’re setting up secrets for the first time or trying to manage an ever-growing list of .env files, this guide explains the core concepts of secrets management with real-world context and step-by-step examples. Each chapter pairs a short video with updated guidance to help your team build a more secure and scalable workflow.

Explore some of the key ways Doppler helps teams manage secrets more securely and efficiently. Click any feature to jump to the full explanation. 

 for more information on our features and how to set them up in the platform.

A practical starting point for building secure, scalable secrets management from day one.

Introduction

API keys, database credentials, and service tokens are essential to how software runs, but managing them can feel like an afterthought. Every application depends on them, yet they are usually managed in ways that are inconsistent, insecure, or difficult to scale.

This chapter introduces secrets management, why it matters, and how Doppler helps teams bring structure, security, and automation to the way secrets are handled across environments.

What are secrets, and why do they matter?

Secrets are sensitive values that help services authenticate with APIs, access infrastructure, and manage encrypted data. Most development teams start by managing them with .env files, environment variables, or hardcoded values. These approaches can work in the short term, but become fragile as infrastructure and teams grow.

Without a system for managing secrets, it becomes difficult to track where values are stored, whether they are up to date, or who has access. This creates both operational complexity and security risk.

Over time, scattered secrets lead to problems. Teams may accidentally commit secrets to source control, share them in chat, or lose track of which environments are using which values. When a credential needs to be rotated or revoked, it often requires multiple manual steps across different tools.

Even small inconsistencies can result in bugs, broken deploys, or outages. Without a reliable way to manage secrets, teams are forced to choose between moving quickly and maintaining security.

Doppler gives teams a centralized platform for managing secrets. It replaces local files, ad hoc scripts, and scattered config values with a single place to define, update, and access secrets across every environment.

 in Doppler, you’re setting up a space to manage secrets for your company, team, or project. Each 

 inside that workplace can represent a specific service or application. Projects are organized into environments like development, staging, and production. This way, secrets can be scoped to match your infrastructure.

Secrets can be added manually or imported in bulk. They are masked by default for safety but can be viewed when needed. You can also roll back changes, track updates, and sync values automatically across systems.

 makes it easy to inject secrets at runtime. After linking a folder to a project and environment using doppler setup, you can start your application with the correct secrets already loaded.

You can also use doppler secrets to inspect values in the terminal. This keeps your local environment consistent with the rest of the team without needing to share .env files or manually copy config.

For full installation instructions and supported systems, see the CLI docs 

Doppler integrates with a wide range of tools, supporting both local development and the systems that power your infrastructure and deployments.

For developers working locally, integrations with 

 make it easy to manage secrets directly from your editor. These tools help keep secrets close to your code without requiring manual updates or switching between platforms.

Doppler also connects with popular CI/CD services, hosting platforms, and cloud providers. Secrets can be automatically synced to tools like GitHub Actions, Vercel, AWS, and Kubernetes, ensuring that each environment always has the most up-to-date values.

Whether you are working in your editor or deploying to production, Doppler extends to meet you where you are. These 

 make it easier to keep secrets secure and in sync across your entire workflow.

Now that secrets are centralized, the next step is managing who has access and how permissions are applied. In 

, we’ll cover how to invite teammates, assign roles, and keep secrets protected without slowing anyone down.

Why credentials matter, where teams go wrong, and how centralization changes everything.

What is secrets management?

Managing secrets is rarely a solo task. As soon as multiple developers are involved, structure becomes essential. Without it, secrets get shared in DMs, stored in personal config files, or lost in cloud dashboards that only one person knows how to access.

 around secrets in a secure, scalable way without introducing friction.

Note: A few new features have launched since this video was recorded. Doppler now supports OIDC for secure CI/CD auth, change requests for reviewing secret updates, and analytics dashboards to see how your team’s using the platform. We’ll cover all of these later in the chapter.

Doppler is built to support teams at every stage, from solo developers to growing startups and enterprise organizations. The platform is available across three plans: Developer, Team, and Enterprise.

The Developer plan is free and best suited for individuals or small teams just getting started. It includes a single workplace, unlimited projects, and access for up to five users.

The Team plan is designed for more collaborative use cases. It adds features like project-based roles and permissions, access logs, and integrations with popular CI/CD platforms.

The Enterprise plan includes everything in the Team plan, along with advanced capabilities such as SAML SSO, SCIM provisioning, custom roles, user groups, and extended logging support. These features help larger organizations manage access and scale securely across teams.

As we go through this chapter, we’ll note when specific features are tied to a particular plan. You can also view a full comparison 

Developers often need to test locally with secrets that differ from shared values. 

 let each user define a private version of a configuration that only applies to their own machine. This helps reduce the need for manual edits to environment files or shared secrets during development.

Personal configs are available across all plans and live within the environment settings panel. Only the person who creates a personal config can view or use it.

Managing secrets securely requires more than just storing them in the right place. Teams need to control who can view and modify secrets and in which environments. Role-based access makes it easier to protect production, prevent accidental changes, and maintain separation between responsibilities.

On the Developer plan, all users share the same level of access. Each user's workplace role is set to "Owner" and project role set to "Admin" which grants full access for both workplace and project permissions.

The Team plan introduces built-in roles at both the workplace and project level. Owners and Admins can manage projects and invite users. Collaborators and Viewers can be scoped to specific environments, giving teams more flexibility without compromising security.

The Enterprise plan builds on this by allowing teams to define 

. These can be tailored to match internal policies or specific workflows, providing more granular control.

Being able to track what changed, when, and by whom is essential for collaboration and troubleshooting. 

 provide visibility into changes across your workspace, while secret version history allows you to roll back values if something breaks.

The Developer plan includes access to logs from the past three days, giving individuals short-term visibility into changes.

The Team plan provides 90 days of activity logs, version history, and rollback support. It also allows you to send activity events to Slack, Microsoft Teams, or Discord for easier monitoring.

The Enterprise plan includes full activity logs and supports exporting events to tools like Splunk, Sumo Logic, and Datadog. You can also send real-time activity updates to Slack, Microsoft Teams, or Discord. Each log entry includes a unique URL and can be filtered by secret, user, or access method.

(SSO) simplifies authentication and gives admins more control over who can join a workspace. It also reduces the burden of managing individual login credentials.

Both the Team and Enterprise plans include SSO support. Email-based SSO allows anyone from an approved domain to join without needing an invite. Users can configure SAML-based SSO using identity providers such as Okta or Google Workspace. Domain verification is managed directly in the Doppler dashboard.

User management can get complicated as teams grow. 

 help by letting admins assign roles to entire teams or departments at once, rather than configuring access user by user. Groups can be created through the dashboard, API, or Terraform.

User groups are available on the Enterprise plan and can be added on the Team plan.

Enterprise customers can also enable SCIM to automatically sync users and group data from their identity provider. This helps ensure that team access stays accurate as employees join or leave.

Different teams need different levels of access. While built-in roles cover most use cases, some organizations require more flexibility.

Custom roles allow teams to define their own permission sets that map directly to internal security policies or operational responsibilities. You can control what actions each role can perform like managing secrets, configuring integrations, or approving change requests, and apply those roles across specific projects or environments.

Available as an add-on to the Team plan and included in the Enterprise plan, custom roles work well alongside user groups to scale access control across larger teams.

OIDC authentication with service accounts

 allow CI systems and other automated tools to authenticate to Doppler without storing long-lived API tokens. Instead, these systems generate a short-lived OIDC token that Doppler validates at runtime.

This makes automated workflows more secure and easier to manage, especially across multiple environments.

Doppler supports OIDC integration with providers like GitHub Actions, GitLab, and CircleCI. You can authenticate using the CLI or Doppler’s API, and define exactly which claims need to be present for a token to be valid.

Service account identities are available on the Team and Enterprise plans. Identity rules and configuration options are defined in the service account’s settings within Doppler.

Secrets deserve the same review process as code. 

 let teams propose updates to secrets and configs without needing full write access. The right teammates can review, approve, and merge each request, reducing risk and improving accountability.

Change requests are available on the Team and Enterprise plans. On Enterprise, admins can enforce structured approval workflows using 

 that define who must review changes and how many approvals are required.

This feature helps teams stay secure while avoiding access sprawl, and keeps secret changes as deliberate as code commits.

Understanding how secrets are used across your organization is key to maintaining security and scaling safely. 

 provide a clear view into how secrets are being managed, where integrations are active, and how teams are adopting the platform.

Each dashboard focuses on a specific area, such as integration usage or environment activity, and includes charts that help you spot patterns, troubleshoot issues, and make more informed decisions.

Dashboards are permission-based and visible only to users with access to all projects, including workspace Owners and Admins. They are included in the Enterprise plan, and additional dashboard types and insights are planned for future releases.

Next: Integrating secrets into CI/CD and production

Now that your secrets are structured and your team is set up, the next step is putting those secrets to work across your deployment workflows. In 

, we’ll explore how Doppler connects to your CI/CD pipelines, how secrets stay in sync across environments, and how to move from manual config updates to fully automated delivery.


Structure, access controls, and collaboration workflows that scale with your team.

Managing secrets as a team

Once your secrets are centralized and your team is aligned, the next step is making sure those secrets stay in sync across your infrastructure. Whether you're deploying from a 

, syncing to a cloud provider, or running on a managed platform, Doppler helps keep everything up to date without relying on manual steps or scattered configs.

This chapter explores how Doppler fits into your delivery workflows and helps teams move faster while staying secure.


Secrets often live in static config files or are manually copied before deployments. While that approach works early on, it quickly becomes risky as systems grow. Teams lost track of which values are current, which environments are aligned, and who last made a change.

Doppler solves this by acting as a central source of truth. When you update a secret in Doppler, those changes can sync automatically to the services and environments that depend on them. This helps eliminate configuration drift and makes it easier to keep staging, production, and local development aligned.

Doppler offers two types of integrations: native and custom.

Native integrations are configured through the Doppler dashboard and are made up of two parts: connections and syncs.

Connections are created at the workplace level and control how Doppler authenticates with providers like 

Syncs are configured at the environment level and define what secrets to sync and how they should be delivered.

This structure gives admins control over provider access while letting developers manage syncs in the context of their own projects and environments.

Custom integrations are available for teams that want more flexibility. Using Doppler’s CLI, REST API, or Terraform provider, you can script how secrets are fetched, injected, or synced across any service in your stack.

Doppler supports all major CI/CD providers, including 

 in your pipeline, you can securely pull secrets at runtime and inject them directly into your deploy or build steps.

This means you no longer need to store secrets in your pipeline config or manually update them when values change. The Doppler CLI ensures your CI/CD systems always pull the latest versions of your secrets without compromising security.

A single source of truth for every environment

By treating Doppler as the system of record for secrets, teams can reduce manual work and minimize risk. Developers always know where to find the latest credentials. Pipelines don’t break due to outdated values. Production deploys no longer rely on someone who remembers to update a config file.

Integrated secrets management ensures consistency across every environment, from development through to production.

As infrastructure and teams grow, secrets management becomes more complex. In 

, we’ll look at how Doppler helps organizations manage secrets across multiple services, automates secret rotation, and supports long-term operational and security best practices.

Connect secrets to your delivery pipelines and eliminate manual config errors.

Integrating secrets into CI/CD and production

As teams grow and applications evolve, secrets management needs to go beyond syncing values. It becomes about maintaining consistency, supporting best practices like rotation, and preventing config drift across environments. Doppler is designed to help teams manage secrets confidently over time, without introducing overhead.

This chapter covers long-term secrets management strategies and how Doppler supports scale through visibility, versioning, environment structures, and automation.

Visibility controls that fit your workflow

Doppler makes it easy to control how secrets are displayed in the dashboard with three 

Unmasked secrets are always visible to users with access

Masked secrets are hidden by default and require a click to view

Restricted secrets are never visible, even to users with access to the config

Visibility settings help teams share access while limiting exposure. For example, restricted secrets can be used when a value must remain confidential, even within the team, or when using approval workflows like change requests.

Secret visibility types are available on all plans.

Accidental changes and misconfigurations happen. Doppler tracks every change to your secrets and allows you to 

 to previous versions at any time. Each rollback is logged in the activity history and applies at the environment level. This helps teams recover quickly and maintain an auditable trail of changes.

Full version history and rollback capabilities are included in the Team and Enterprise plans. The Developer plan offers a limited 3-day activity log without rollback support.

Referencing secrets across projects and environments

Rather than copying values from one place to another, Doppler lets you reference secrets across projects, environments, or even entire workplaces. This keeps your configurations cleaner and reduces duplication. When a referenced secret is updated, all configs that use it automatically stay in sync.

You can use secret references to share values like database URLs, API keys, or access tokens across multiple services without introducing the risk of drift or mismatched configs.

Secret referencing is available on all plans.

 allow you to create a copy of an environment’s configuration that inherits its values but can be overridden when needed. This is especially useful for feature development, testing, or staging workflows where most secrets should remain the same, but a few need to be temporarily adjusted.

By using branch configs, teams can experiment safely without disrupting shared environments or manually managing separate files.

Branch configs are available on the Team and Enterprise plans.

Doppler’s compare feature makes it easy to check for differences between environments. Whether you’re looking at development and production or comparing across projects, you can identify missing keys, outdated values, or unexpected overrides in just a few clicks.

This helps prevent bugs caused by inconsistent configs and gives teams a reliable way to ensure that secrets are aligned before deploying.

This feature is available on the Team and Enterprise plans.

 regularly is one of the most effective ways to reduce the risk of exposure or misuse. Doppler lets you set rotation reminders for any secret, helping your team build better hygiene into its workflow. These reminders can be configured based on your security policies and are visible in the dashboard alongside the secret itself.

For teams with strict compliance requirements or zero-trust policies, secret rotation is a must. Doppler gives you the tools to enforce it without relying on spreadsheets or guesswork.

Rotation reminders are available on the Team and Enterprise plans.

Next: Automating secrets management with Doppler

, we will explore how Doppler supports automation through integrations, lifecycle management, and platform-wide policies that keep your secrets synced, monitored, and secure without constant oversight.

Keep environments aligned, reduce drift, and support long-term security hygiene.

Managing secrets at scale

 is one of the most important and often overlooked parts of secrets management. While storing and syncing secrets is a great first step, keeping them secure over time requires regular updates. Many teams put off rotation because of complexity, downtime risk, or lack of automation tools. But skipping it increases the likelihood of a credential leak or misuse.

This chapter focuses on how Doppler helps teams automate rotation at scale, reduce operational risk, and meet compliance requirements without disrupting deployments.


Secrets, like passwords, become more vulnerable the longer they stay the same. A leaked API key or an unrotated database credential can create major security risks. Many compliance frameworks, including SOC 2 and ISO 27001, treat rotation as a core requirement for secure infrastructure.

Still, rotation is often neglected due to:

Concerns about downtime during credential changes

The complexity of managing credentials across multiple clouds and systems

Lack of tooling to automate and monitor the process

 approachable and achievable for teams of all sizes.

On the Team and Enterprise plans, Doppler supports automatic rotation for common credential types, including:

 on a schedule or on demand. Once updated, Doppler syncs the new secrets to the systems that need them. With integrations in place, rotated values are injected automatically into your environments without downtime or manual updates.

Doppler offers two models for secret rotation depending on your infrastructure and security requirements.

API-based rotation, available on the Team and Enterprise plans, uses provider APIs to rotate secrets like access keys or tokens. This method is ideal for cloud-native services and is easy to configure.

Proxied rotation, available on the Enterprise plan, is designed for teams with private infrastructure. It uses an open source, serverless agent that runs inside your network, giving Doppler secure access to rotate secrets for internal systems such as on-prem databases without exposing them to the public internet. The proxy is fully controlled by your team and can be deployed using your existing cloud environment.

Doppler supports a two-secret rotation strategy, alternating between active and inactive credentials during each rotation cycle. This gives systems time to switch over to the new secret before the old one is removed.

By overlapping credentials during rotation, teams can avoid interruptions, reduce risk, and roll out changes more confidently.

Automated rotation helps enforce security policies and meet compliance frameworks like SOC 2, ISO 27001, and HIPAA. Doppler records every rotation event in the activity log, creating a reliable audit trail for security reviews or incident response.

By making rotation part of the default workflow, teams can maintain compliance without slowing down development or requiring extra overhead.

From centralizing secrets and managing teams to integrating with CI/CD and automating rotation, Doppler is built to help you scale securely. In the 

, we’ll recap key strategies and explore how to turn these best practices into long-term systems for secret operations.

Rotate credentials without the chaos and bring secure automation into every environment.

Automating secrets management with Doppler

By now, you’ve seen how thoughtful secrets management can reduce risk, speed up development, and create healthier engineering workflows. What starts with cleaning up environment files can quickly grow into a system that scales alongside your team and infrastructure.

Why centralizing secrets is essential from day one

How to collaborate securely using roles and structured configs

Ways to integrate Doppler into CI/CD pipelines and hosting platforms

Tools for visibility, rotation, and long-term consistency

How to move beyond manual updates with automation and approvals

Secrets management is no longer just a security checkbox. It is a foundational part of how modern teams ship software. Getting it right means fewer bugs, fewer outages, and fewer unknowns hiding in your stack.

Doppler was built to support these workflows from the beginning. Whether you're working solo or scaling across teams and cloud environments, the platform helps you move faster while staying secure.

Turning on rotation reminders to build better habits over time

If you're already using Doppler, dig into features like Change Requests, Branch Configs, or Integration Syncs to take your workflow further and explore our 

Secrets are too important to be scattered or outdated. With the right foundation, they become something your team can trust and rely on without extra effort.

Wrapping it all up

Turn best practices into everyday workflows and build a system your team can trust.

Wrapping it all up

What’s next?

Enter the new era of secrets management