How often should secrets be rotated?

As a starting point: API keys around every 90 days, database passwords around every 180 days, and immediately for any credential known or suspected to be compromised.

Should dev and production share secrets?

No. Use entirely separate credentials per environment so a leaked development key cannot touch production data.

How do I respond to a leaked secret?

Rotate the compromised credential immediately, audit access logs for the window it was exposed, and notify affected users if the exposure could have touched their data.

complianceHowTo

MCP Secret Management Best Practices

Manage API keys, database credentials, and tokens for MCP servers with validated environment variables, a secret manager, and a rotation policy.

Quick Answer / TL;DR

Never hardcode secrets in source code. Load them from environment variables validated at startup, move production secrets into a manager such as AWS Secrets Manager or Vault instead of plain env vars, and rotate on a schedule (shorter for high-value credentials) rather than only when a leak is suspected.

Key Takeaways

Validate required environment variables at startup so a missing secret fails loudly, not deep inside a request handler.
In production, prefer a secret manager over plain environment variables so rotation and access logging come for free.
Different secrets per environment; a dev credential should never work against production.

Validated environment variables

Parse and validate process.env at startup with a schema so a missing or malformed secret fails immediately with a clear error, instead of surfacing as a confusing runtime failure the first time a tool needs it.

text

const EnvSchema = z.object({
  DATABASE_URL: z.string().url(),
  API_KEY: z.string().min(10),
  JWT_SECRET: z.string().min(32),
});

const env = EnvSchema.parse(process.env);

Secret managers for production

A secret manager adds access logging, fine-grained IAM policies, and rotation without redeploying, which plain environment variables cannot give you.

typescript

const client = new SecretsManagerClient({ region: "ap-south-1" });

async function getSecret(secretName: string): Promise<string> {
  const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: secretName }));
  return SecretString ?? "";
}