The Canyon ReviewSecrets managers, compared without the theater
Vault, AWS Secrets Manager, Doppler, Infisical and SOPS compared for small teams. What rotation actually costs and who needs it.
Doppler or Infisical for app config, SOPS for the infra repo, AWS Secrets Manager if you're all-in on AWS and can stomach per-secret pricing. Vault only with a platform team. That's the placement; the reasoning follows.
Criteria: developer workflow 35%, price at 50 secrets / 10 people 25%, rotation and audit reality 25%, escape hatch 15%. Prices as of June 2026, list.
The table
| Rank | Tool | Rough monthly | Sweet spot |
|---|---|---|---|
| 1 | Doppler | free tier, then ~$8/seat | app env vars, many environments |
| 2 | Infisical | free tier, self-host free | same, open source temperament |
| 3 | SOPS | $0 | secrets that live in git anyway |
| 4 | AWS Secrets Manager | $0.40/secret + API calls | AWS-native services |
| 5 | Vault | your platform team's quarter | dynamic credentials at org scale |
What teams actually do versus what they buy
Most teams under fifty people have the same secrets problem: a pile of API keys, per-environment database URLs, and one person who knows which Slack DM has the Stripe key. That problem is solved by any tool in the top three, and none of them requires an unseal ceremony.
Doppler and Infisical are close enough that the tiebreak is temperament: Doppler is more polished SaaS, Infisical is open source with credible self-hosting. Both put secrets injection one CLI wrapper away from any runtime, which is the feature that kills the .env file for good.
SOPS is the correct answer for Terraform state adjacent secrets and anything that already lives in a reviewed repo: encrypted files, keys in KMS or age, diffs in pull requests. It scores zero on rotation and we ranked it third anyway, which tells you how we weigh honest simplicity.
About rotation
Automatic rotation is the most-cited, least-used feature in this category. AWS Secrets Manager genuinely rotates RDS credentials with managed rotation; Vault mints dynamic credentials that expire on their own, which is the actual state of the art. Everything else calls "we'll remind you" rotation. If your compliance regime requires rotation, buy it where it's real. If not, per-secret pricing (40 cents each, monthly, plus API calls) is a strange bill for a key-value store.
The skip
Self-hosting Vault to store twelve API keys. It's a superb piece of engineering whose operational floor (storage backend, unsealing, HA, policy language) is priced in engineer-weekends, and at small scale you will pay it to reimplement what Doppler's free tier does before lunch.