Concept / Term · Established

Secrets Management

Credential protection practice

What does Secrets Management mean?

Securely storing, issuing, rotating, auditing and revoking sensitive credentials such as API keys, passwords and certificates.

Keep exploring

API KeyA secret code that identifies and authorises your app when it calls an API. It should be kept private, like a password.
OAuthThe standard that lets an app access your data on another service without seeing your password. It is the foundation of 'Sign in with Google' and similar sign-in buttons.
SSOLogging in once to gain access to many connected apps without re-entering your details.
MFA / 2FARequiring a second proof of identity beyond the password, usually a code from a phone or an authenticator app.
Encryption at rest / in transitAt rest means stored data is encrypted on disk; in transit means it is encrypted while moving across the network. Buyers and auditors will ask about both.
Pen TestAn authorised simulated attack on your system by security specialists, to find weaknesses before someone else does. Often required before an enterprise contract.
Vulnerability / CVEA known security weakness. CVE is the public catalogue that gives each one a reference number so everyone can track it.
GDPR / Data ProtectionThe rules on handling personal data: what you may collect, why, how long you keep it and what rights people have over it. Non-compliance carries real financial penalties.