Secrets Management

Scripts constantly need API keys, passwords, and connection strings. SecretManagement gives every script one way to get them, whatever vault stores them.

# illustrative
Install-Module Microsoft.PowerShell.SecretManagement, Microsoft.PowerShell.SecretStore -Scope CurrentUser
Register-SecretVault -Name LocalStore -ModuleName Microsoft.PowerShell.SecretStore -DefaultVault

Set-Secret -Name GitHubToken -Secret 'ghp_example123'
$token = Get-Secret -Name GitHubToken -AsPlainText
Get-SecretInfo | Select-Object Name, VaultName

• SecretManagement is the common interface (Get-Secret, Set-Secret); vault extensions store the secrets.
• SecretStore is a local, encrypted vault. Extensions also exist for Azure Key Vault, KeePass, 1Password, HashiCorp Vault, and the Windows Credential Manager.
• Switch vaults (local for development, Key Vault in production) without changing the scripts.

Other options

• Environment variables — CI systems (GitHub Actions, Azure DevOps) inject secrets as environment variables and mask them in logs.
• Export-Clixml on Windows encrypts a credential for the current user on the current machine:

# illustrative
Get-Credential | Export-Clixml -Path "$HOME\svc.cred"
$cred = Import-Clixml -Path "$HOME\svc.cred"

• Managed identities in Azure remove the secret entirely — the platform authenticates the machine or function itself.

Rules

• Never commit secrets to source control; scan repositories for them.
• Keep secrets as SecureString or in variables that never get printed; avoid -AsPlainText until the moment you need it.
• Rotate secrets, and give each script the narrowest permissions it needs.