How do you manage secrets and connection strings securely with Secret Manager in development and Azure Key Vault in production?

Short answer

Secret Manager stores secrets in a local folder outside project files to prevent them from being committed to Git; production apps retrieve secrets from Azure Key Vault or AWS Secrets Manager.

Explanation

dotnet user-secrets is for local development: it stores keys in an operating-system user folder and integrates them with builder.Configuration. In production and cloud environments, connect the application to a secure central store such as Azure Key Vault through Azure.Security.KeyVault.Secrets and Managed Identity, without storing passwords in configuration files.

Code example

// For local development through the CLI:
// dotnet user-secrets init
// dotnet user-secrets set "DbPassword" "SuperSecret123"

// In production code with managed identity:
builder.Configuration.AddAzureKeyVault(new Uri(keyVaultUrl), new DefaultAzureCredential());

Common mistakes

• Putting real database passwords in appsettings.json and committing the file to Git repositories.

Follow-up questions

• What is the .NET Data Protection API, and where should its keys be stored for production servers running across multiple instances?

Sources

• Microsoft Learn — Safe storage of app secrets in development in ASP.NET Core