Securing API secrets and credentials with Azure Key Vault

Marketplace integrations live on credentials: OAuth client secrets, refresh tokens, API keys. Keeping them in code or config files is a real risk. Azure Key Vault, together with Managed Identity, lets you manage them securely and automatically.

The problem of scattered secrets

Hardcoded secrets or unmanaged environment variables lead to accidental leaks (e.g. in repositories or logs), manual and forgotten rotations, and no traceability of who accesses what. Centralising them is the first step towards security.

Key Vault at a glance

Element	Typical use
Secret	Client secrets, refresh tokens, API keys
Key	Cryptographic keys for signing/encryption
Certificate	TLS or authentication certificates

Managed Identity: no credentials to access credentials

The classic paradox is: to read secrets, you need a secret. Managed Identity solves it: the Function or container gets an Azure-managed identity, and you grant that identity access to Key Vault. No credentials are stored anywhere: authentication happens through the platform.

Secret rotation

Secrets should be changed periodically. With Key Vault, rotation is manageable without redeploying the application: you update the value in the vault and the app re-reads it. Account for:

• secret versioning (Key Vault keeps versions);
• app-side caching with expiry, to avoid querying the vault on every call;
• an overlap window during rotation, so in-flight operations are not interrupted.

The OAuth token case

Marketplace access tokens expire; refresh tokens must be protected. A robust pattern: keep the refresh token in Key Vault, obtain and cache the access token in memory until shortly before expiry, and renew it in a concurrency-safe way (one refresh at a time) to avoid duplicate requests when multiple workers discover together that the token has expired.

Least-privilege principle

Each application should access only the secrets it needs. With Key Vault access policies or RBAC you grant targeted permissions (read-only on the necessary secrets), reducing the risk surface.

Common mistakes

• secrets in code or in the repository;
• a credential to access credentials, instead of Managed Identity;
• no rotation, or rotation that interrupts the service;
• refresh tokens renewed in parallel without coordination.

Conclusion

Azure Key Vault with Managed Identity removes secrets from code, enables secure rotation and enforces least privilege. For marketplace integrations, where tokens are at the heart of authentication, it is a non-negotiable security foundation. Reference: Azure Key Vault (Microsoft Learn).