Vault

Vault is the industry standard for managing secrets: API keys, database passwords, encryption keys, anything that shouldn't live in environment variables or config files. It stores secrets, controls who can access them, rotates them automatically, encrypts data, and logs every access. It's a bank vault for your application secrets.

built by HashiCorp. The most widely deployed secrets management tool in production infrastructure.

The catch: HashiCorp relicensed Vault from MPL to BSL (Business Source License) in 2023. You can still self-host for free for your own use, but you cannot offer Vault as a managed service competing with HashiCorp. This triggered the OpenBao fork. Also, Vault is powerful but complex; setting up HA (high availability), configuring auth methods, managing policies, and operating the unsealing process requires real infrastructure knowledge. This is not a 'docker run and forget' tool.