When looking to avoid keeping secrets in code (so it doesn’t get checked into source control) and having them encrypted in some fashion (so they’re not exposed if a machine is compromised), I’m missing something obvious here.

Azure KeyVault appears to have built in auto-authentication, but only if your app is hosted on Azure, which makes it not work for on-premise deployments.

That leaves me with one gaping hole in the security plan – I can move the handful of secrets into one of these tools, but I then somehow need to authenticate to the tool itself.

This makes it seem like it accomplishes nothing, as we’ve just replaced one secret with another.

What key piece am I missing here?