In short: Keeper Secrets Manager is a zero-knowledge service for storing API keys, database passwords, certificates and other machine secrets, and delivering them to applications, CI/CD pipelines and infrastructure without hard-coding. It integrates with GitHub Actions, Jenkins, Kubernetes, Terraform, Ansible and Docker, and is a per-user add-on to Keeper business plans or included in KeeperPAM.
What Keeper Secrets Manager is
Applications need credentials too: database connection strings, API keys, cloud access keys, certificates and SSH keys. Too often they end up in source code, configuration files or CI/CD variables, where they are copied, forgotten and leaked. Keeper Secrets Manager (KSM) stores them in the same zero-knowledge vault as your other Keeper records and lets machines fetch them securely at run time.
Developers and DevOps teams use it to:
- Remove hard-coded secrets from code and config files
- Inject secrets into pipelines in GitHub Actions, Jenkins and other CI/CD tools
- Feed infrastructure tools such as Terraform, Ansible, Kubernetes and Docker
- Rotate credentials automatically for Active Directory users, machines, databases and service accounts
- Give AI agents controlled access to secrets through Keeper's MCP integration rather than pasting them into prompts
Tools, SDKs and integrations
| Area | What is available |
|---|---|
| SDKs | Java/Kotlin, JavaScript, Python, .NET/PowerShell, Go, Rust and Ruby |
| CI/CD | GitHub Actions, Jenkins and other pipeline integrations |
| Infrastructure as code | Terraform, Ansible, Kubernetes and Docker |
| Developer tools | Secrets Manager CLI, a REST API and plugins for VS Code, Cursor and JetBrains IDEs |
| Cloud | AWS, Azure and Google Cloud, including hybrid environments |
Each application or device is registered with its own access, so you can see which machine used which secret and revoke one without affecting the others.
How it is licensed
Keeper Secrets Manager is sold in two ways:
- Secrets Manager add-on to a Keeper business password manager plan, licensed per user per year. Admins then switch it on for the users and roles who manage secrets. Keeper adds it through its sales team rather than the admin console, which we arrange for you.
- Included in KeeperPAM. Keeper notes that moving from the Secrets Manager add-on to PAM brings unlimited API calls and the wider PAM features, so if you also want privileged sessions or password rotation at scale, PAM is often the better route.
We will check which model suits your estate before quoting. Ask us for a quote; we confirm the term, usually annual, when we do.
Requirements and deployment
Secrets Manager is cloud-hosted, so there is nothing to install centrally. You create an application in the Keeper vault, share a folder of secret records with it and issue a one-time access token to the machine, pipeline or container that needs them. The SDK or integration then retrieves secrets on demand and can cache them locally. Because decryption happens on the client, Keeper's zero-knowledge model applies to machine secrets as well as user passwords.
You need a Keeper Business or Enterprise tenant (or KeeperPAM) to hold the vault the secrets live in.
Secrets Manager and staff passwords together
Keeping machine secrets in the same platform as staff credentials has practical benefits. One set of admin roles and audit logs covers both, the same zero-knowledge encryption applies, and when someone leaves you can see which shared folders and applications they had access to. Secrets can also be passed straight into KeeperPAM sessions, so an admin can connect to a database using a credential that rotates automatically and is never displayed.
Who it suits and how we help
KSM suits software teams, IT teams running scripts and scheduled tasks, and managed providers who want secrets in the same platform as staff passwords rather than a separate tool. We help you pick add-on or PAM licensing, set up applications and folder structure, and move secrets out of code repositories. See also identity, MFA and privileged access for other approaches.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Keeper Secrets Manager licensed per user?
Yes. As an add-on to a Keeper business plan it is licensed per user per year, for the people who manage secrets. It is also included in KeeperPAM, which is licensed per user and brings unlimited API calls.
Does Keeper Secrets Manager work with GitHub Actions and Terraform?
Yes. Keeper provides integrations for GitHub Actions, Jenkins, Terraform, Ansible, Kubernetes and Docker, plus SDKs in several languages, a CLI and IDE plugins.
Is Keeper Secrets Manager zero-knowledge?
Yes. Secrets are encrypted and decrypted on the client, using the same zero-knowledge model as the Keeper vault.