API keys and service credentials remain one of the messiest parts of modern software development.
The problem is not simply that secrets need to be stored securely. We already have good tools for that. The larger unsolved problem is that credentials are created, copied, scoped, stored, injected, rotated, revoked, and audited differently across every API provider, cloud platform, hosting service, CI system, database, analytics tool, and developer environment.
This becomes painful during normal development. It becomes critical after a compromise.