Automations need identities. They call APIs, retrieve files, update records, send messages, and connect to model providers. Those actions usually depend on credentials, and poorly managed credentials can give an otherwise modest workflow far more access than it needs.
Do not embed secrets in code or prompts
API keys, passwords, private keys, and access tokens should not be committed to source control or pasted into prompt templates, client-side JavaScript, tickets, or documentation. Use an appropriate server-side secrets mechanism or managed secret store and retrieve credentials only where the workload needs them.
Prefer workload identities over shared human accounts
Where platforms support it, give an automation its own service or workload identity. That makes permissions, logs, rotation, and revocation easier to manage. Avoid running important production workflows through a personal employee account whose password, role, or employment status can change.
Apply least privilege
Grant the smallest practical set of permissions. A workflow that reads one data source should not receive broad write access across the platform. Separate credentials between environments and between automations when compromise of one credential would otherwise expose unrelated systems.
Plan rotation before exposure happens
Document how credentials are replaced and revoked. Rotation should not depend on one employee remembering an undocumented sequence. Where feasible, automate rotation or use short-lived credentials that reduce the value of a stolen secret.
Keep secrets out of logs
Debugging can accidentally expose credentials through request headers, environment dumps, exception traces, or copied payloads. Configure logging deliberately and redact sensitive fields. Restrict access to logs because operational logs can themselves become a source of sensitive information.
Know who owns every credential
An inventory should connect each production credential to a system, purpose, owner, environment, and revocation path. Remove credentials that are no longer required. Orphaned tokens often survive because nobody is confident that disabling them is safe.
Respond quickly to suspected exposure
If a secret may have been disclosed, revoke or rotate it, investigate relevant logs, determine what permissions it carried, and look for unexpected use. Replacing the visible secret without understanding its access can leave the underlying incident unresolved.
Credential management is routine operational security. For automation, that routine discipline is especially important because machine identities can act continuously and at speed.