One Interface. Any Secret Backend.
A unified .NET 10.0 abstraction layer for 14 secret backends including Azure Key Vault, AWS, Google Cloud, Oracle Vault, PostgreSQL, Scaleway, OVH, IBM Cloud, Aliyun KMS, Passbolt, Tencent Cloud, HashiCorp Vault, CyberArk Conjur, and local encrypted storage. Inspired by Kubernetes External Secrets.
ISecretProviderdotnet add package SecretsManager.Coredotnet add package SecretsManager.FileSystemWhy SecretsManager?
A modern approach to secret management in .NET
Unified API
Get, put, version, and delete secrets with one interface, regardless of the backend.
Multi-Provider
Swap between Azure, AWS, GCP, Scaleway, PostgreSQL, OVH, Passbolt, Tencent Cloud, HashiCorp Vault, CyberArk Conjur, or encrypted local files without changing your business logic.
Zero Bloat
Modular design. Only install the NuGet packages for the providers you actually use.
Versioning
First-class support for secret history across all providers.
JSON Extraction
Query nested JSON values directly via dot-path syntax.
Flexible Config
Configure via Fluent API, Environment Variables, or ESO-style YAML.
Configure Your Way
Choose the configuration style that fits your workflow
- Fluent API
- IOptions<T>
- Environment
- YAML
var provider = new SecretProviderBuilder()
.WithFileSystem(options =>
{
options.BasePath = "/etc/secrets";
options.EncryptionKey = "my-encryption-key";
})
.Build();
var secret = await provider.GetSecretAsync("db-password");
Console.WriteLine(secret.Value);
{
"SecretsManager": {
"FileSystem": {
"BasePath": "/etc/secrets",
"EncryptionKey": "base64-encoded-key"
}
}
}
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSecretsManager();
builder.Services.Configure<FileSystemOptions>(
builder.Configuration.GetSection("SecretsManager:FileSystem"));
// Or bind and build in one step
var provider = new SecretProviderBuilder()
.ConfigureFileSystem(builder.Configuration)
.Build();
var secret = await provider.GetSecretAsync("db-password");
export SECRETS_PROVIDER=filesystem
export SECRETS_FILESYSTEM_PATH=/etc/secrets
export SECRETS_FILESYSTEM_ENCRYPTION_KEY=my-key
// In your C# code:
var provider = new SecretProviderBuilder()
.WithFileSystem()
.FromEnvironment()
.Build();
var secret = await provider.GetSecretAsync("db-password");
# secretstore.yaml
provider:
filesystem:
path: /etc/secrets
encryption:
key: base64encodedkey
var provider = new SecretProviderBuilder()
.WithFileSystem()
.FromYamlFile("secretstore.yaml")
.Build();