{ "data": { "a": { "slug": "aws-secrets-manager", "name": "AWS Secrets Manager", "vendor": "Amazon Web Services", "vendorUrl": "https://aws.amazon.com/secrets-manager/", "kind": "http-api", "category": "secrets", "summary": "Managed secrets store priced per secret and per API call, with IAM for access, KMS for encryption, CloudTrail for audit, cross-region replication and rotation either managed (RDS, Aurora, DocumentDB, Redshift) or by a Lambda function you own.", "url": "https://www.anchorterminal.com/tools/aws-secrets-manager", "markdownUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json", "transports": [ "http" ], "remoteUrl": "https://secretsmanager.us-east-1.amazonaws.com", "packages": [ { "registry": "npm", "name": "@aws-sdk/client-secrets-manager" }, { "registry": "pypi", "name": "boto3" } ], "auth": "mixed", "authNotes": "SigV4-signed requests with AWS credentials. On AWS compute the runtime gets short-lived credentials from an IAM role; elsewhere it needs AWS credentials of its own. The caller needs secretsmanager:GetSecretValue and, for a customer-managed KMS key, kms:Decrypt. Resource policies on a secret can grant cross-account access.", "pricing": "usage", "pricingNotes": "$0.40 per secret a month and $0.05 per 10,000 API calls, with no charge for the new versions rotation creates. New AWS customers since 15 July 2025 get up to $200 of Free Tier credit usable on Secrets Manager, with the free plan lasting 6 months and all credits expiring within 12 months; an AWS account needs a payment method (https://aws.amazon.com/secrets-manager/pricing/).", "priceSummary": "$0.40 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 15195593, "pypiWeekly": 578449536, "asOf": "2026-09-30" }, "docsUrl": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/", "llmsTxt": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/llms.txt", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "infra.aws" ], "tags": [ "hosted", "closed-source", "usage-priced", "card-required", "llms-txt", "typescript", "python", "go", "enterprise", "eu" ], "graded": true, "anchor": { "graded": true, "score": 78.1, "grade": "A", "agentReady": true, "rank": 15, "ranked": true, "rankOf": 452, "categoryRank": 2, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 90, "maintenance": 65, "payments": 20, "reliability": 87, "schema": 96, "security": 88, "transparency": 79 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.", "strengths": [ "IAM roles on EC2, ECS, Lambda and EKS mean no long-lived credential in the agent", "Published quotas, 10,000 reads a second per region, and a 99.99% SLA", "Idempotent writes on ClientRequestToken and immutable versions", "CloudTrail entry for every call, and KMS encryption with your own key if you want", "llms.txt for the user guide and typed service models in every AWS SDK" ], "weaknesses": [ "Every API call is billed, so per-request reads add up and the docs push you to cache", "Rotation outside the RDS family means writing and running a Lambda function", "Off-AWS agents need AWS credentials of their own, often a static access key", "No Secrets Manager MCP server, and the general AWS API server's read-only mode still allows GetSecretValue", "The security.txt at aws.amazon.com expired on 24 September 2026, and signup needs a payment method" ], "agentNotes": [ "Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard", "Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged", "Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second", "Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes", "Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.9, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 78.1 } ], "editorialScores": { "ergonomics": 90, "maintenance": 65, "payments": 20, "reliability": 87, "schema": 96, "security": 88, "transparency": 63 }, "provenanceScore": 95 }, "connect": { "install": "pip install boto3 # or: npm i @aws-sdk/client-secrets-manager", "http": "curl -X POST \"https://secretsmanager.us-east-1.amazonaws.com/\" \\\n --aws-sigv4 \"aws:amz:us-east-1:secretsmanager\" --user \"$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY\" \\\n -H \"X-Amz-Target: secretsmanager.GetSecretValue\" -H \"Content-Type: application/x-amz-json-1.1\" \\\n -d '{\"SecretId\":\"prod/myapp/db\"}'" }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/aws-secrets-manager" }, "sameCompany": [ "amazon-bedrock-guardrails", "amazon-transcribe", "amazon-polly", "aws-mcp-servers", "amazon-ses", "amazon-translate" ], "area": "agent-runtime", "unitPrices": [ { "item": "Stored secret", "unit": "month", "usd": 0.4, "note": "Per secret a month" }, { "item": "API calls", "unit": "1k-calls", "usd": 0.005, "note": "$0.05 per 10,000 calls" } ], "provenance": { "legalEntity": "Amazon Web Services, Inc. (Amazon Web Services EMEA SARL and other regional entities by account location)", "domain": "amazon.com", "domainRegistered": "1994-11-01", "domainNote": "The service lives under aws.amazon.com, a subdomain of amazon.com.", "endpointOnVendorDomain": true, "terms": "https://aws.amazon.com/service-terms/", "privacy": "https://aws.amazon.com/privacy/", "statusPage": "https://health.aws.amazon.com/health/status", "changelog": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/doc-history.html", "securityTxt": "expired", "checked": "2026-10-01", "notes": [ "Service Terms last updated 15 September 2026 name Amazon Web Services, Inc. for most customers and regional entities for Australia, Japan, Korea, EMEA and India. The privacy notice (18 May 2026) gives 410 Terry Avenue North, Seattle, WA 98109-5210.", "security.txt Expires 2026-09-24T16:25:03Z, so it had lapsed when we checked on 1 October 2026. It points to the AWS VDP on HackerOne.", "The pricing page loaded on 1 October 2026 and confirms $0.40 a secret a month and $0.05 per 10,000 calls.", "The document history page returned too many redirects again; the newest Secrets Manager API model change in botocore is from 11 December 2025.", "health.aws.amazon.com/health/status is a JavaScript page; the per-service RSS feed for Secrets Manager in us-east-1 had no items on 1 October 2026." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.json", "live": { "slug": "aws-secrets-manager", "probe": { "target": "https://secretsmanager.us-east-1.amazonaws.com", "method": "get", "lastAt": "2026-10-05T02:29:51.880711959Z", "lastOk": true, "lastStatus": 404, "lastMs": 2026, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 1816, "p95ms24h": 2236, "samples24h": 273, "samples30d": 929, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 29, "ok": 29 } ] }, "versions": [ { "registry": "npm", "name": "@aws-sdk/client-secrets-manager", "version": "3.1146.0", "seenAt": "2026-10-04T16:21:22.18150713Z" }, { "registry": "pypi", "name": "boto3", "version": "1.43.108", "released": "2026-10-02", "seenAt": "2026-10-04T16:21:22.994336287Z" } ], "npmWeekly": 16134158, "pypiWeekly": 576017728, "securityTxt": { "url": "https://amazon.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-10-04T15:15:49.458098289Z" }, "llmsTxt": { "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:22.883710357Z" }, "domain": { "domain": "amazon.com", "registered": "1994-11-01", "source": "https://rdap.verisign.com/com/v1/domain/amazon.com", "checkedAt": "2026-10-04T13:06:18.739682554Z" }, "pages": [ { "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/doc-history.html", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:43:18.235511313Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" }, { "url": "https://aws.amazon.com/secrets-manager/pricing/", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:41:34.797947893Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d96ff3d82a94" } ], "updatedAt": "2026-10-05T02:29:51.880711959Z" } }, "b": { "slug": "doppler", "name": "Doppler", "vendor": "Doppler", "vendorUrl": "https://www.doppler.com", "kind": "http-api", "category": "secrets", "summary": "Hosted secrets manager organised by project, environment and config.", "url": "https://www.anchorterminal.com/tools/doppler", "markdownUrl": "https://www.anchorterminal.com/tools/doppler.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doppler.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doppler.json", "repo": "https://github.com/DopplerHQ/mcp-server", "license": "Apache-2.0 (MCP server and CLI), closed platform", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.doppler.com/v3", "packages": [ { "registry": "npm", "name": "@dopplerhq/mcp-server" } ], "auth": "mixed", "authNotes": "Bearer tokens on api.doppler.com. Service tokens (`dp.st.\u003cenv\u003e.…`) are scoped to one config, read-only by default and can expire with `--max-age`. Service account identities exchange an OIDC token (GitHub Actions, Kubernetes, AWS EC2 or any issuer) for a short-lived Doppler token at POST /v3/auth/oidc, Team plan and above. The MCP server takes `DOPPLER_TOKEN` or `npx @dopplerhq/mcp-server login`.", "pricing": "freemium", "pricingNotes": "Developer plan is free for 3 users then $8 a month per extra user, with 10 projects, 50 service tokens, 3-day activity logs and API-based rotation only. Team $21 a month per user with a 14-day trial, 250 projects, 500 service tokens, service accounts, automatic rotation, 90-day logs and SAML. Enterprise is custom, with dynamic secrets (AWS IAM and Azure service principals), proxied rotation, SCIM, on-prem and a 99.95% SLO. The pricing page says AI agents and non-human identities ride free, and doesn't say whether a card is needed (https://www.doppler.com/pricing, https://docs.doppler.com/docs/dynamic-secrets).", "priceSummary": "$21 / seat-mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 8, "npmWeekly": 3261, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.doppler.com", "llmsTxt": "https://docs.doppler.com/llms.txt", "openapi": "https://docs.doppler.com/openapi/core.json", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "tags": [ "hosted", "closed-source", "freemium", "free-tier", "no-card", "mcp", "openapi", "llms-txt", "typescript", "read-only-mode", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "anchor": { "graded": true, "score": 71.6, "grade": "BB", "agentReady": true, "rank": 79, "ranked": true, "rankOf": 452, "categoryRank": 5, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 76, "payments": 25, "reliability": 90, "schema": 81, "security": 82, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.", "strengths": [ "Service tokens bound to one config, read-only by default, with --max-age expiry", "OIDC service account identities on Team, so shared runners don't hold a static token", "OpenAPI 3.1 and an llms.txt with about 500 Markdown links", "Published per-plan rate limits with retry-after and x-ratelimit headers on a 429", "MCP server with --read-only and --config modes that cut the tool list to 36 or 10" ], "weaknesses": [ "Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts", "The MCP server is experimental, has no tool annotations or value masking, and exposes up to 89 tools by default", "35 open CLI issues, most of the newest without a reply", "The CLI keeps serving its fallback file after a token is revoked, and sends anonymous analytics unless turned off", "No SLA, only a 99.95% SLO on Enterprise" ], "agentNotes": [ "Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- \u003ccmd\u003e` so values never touch disk", "Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail", "Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call", "On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer", "Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.6 } ], "editorialScores": { "ergonomics": 59, "maintenance": 76, "payments": 25, "reliability": 90, "schema": 81, "security": 82, "transparency": 64 }, "provenanceScore": 90 }, "connect": { "http": "curl \"https://api.doppler.com/v3/configs/config/secrets/download?format=json\" \\\n -H \"Authorization: Bearer $DOPPLER_TOKEN\"", "claudeCode": "claude mcp add doppler -e DOPPLER_TOKEN=$DOPPLER_TOKEN -- npx -y @dopplerhq/mcp-server --read-only", "config": { "mcpServers": { "doppler": { "args": [ "-y", "@dopplerhq/mcp-server", "--read-only" ], "command": "npx", "env": { "DOPPLER_TOKEN": "${DOPPLER_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/doppler" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan", "unit": "seat-month", "usd": 21, "note": "14-day trial" }, { "item": "Developer plan, extra user", "unit": "seat-month", "usd": 8, "note": "First 3 users free" } ], "provenance": { "legalEntity": "Doppler Technologies, Inc.", "domain": "doppler.com", "domainRegistered": "1999-01-24", "domainNote": "doppler.com was registered in 1999, long before the company, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://www.doppler.com/legal/terms", "privacy": "https://www.doppler.com/legal/privacy", "statusPage": "https://www.dopplerstatus.com", "changelog": "https://docs.doppler.com/changelog", "securityTxt": "unknown", "checked": "2026-10-01", "notes": [ "Terms name Doppler Technologies, Inc., 440 North Barranca Avenue #5880, Covina, CA 91723, last updated 8 February 2026. Privacy notice updated 17 September 2026, data stored in the United States.", "www.doppler.com/.well-known/security.txt is disallowed by robots.txt, so we couldn't read it.", "www.dopplerstatus.com is Atlassian Statuspage. Its history shows one incident since 3 July 2026 (CLI downloads failing, 16 July) and system outages on 18 November 2025 and 12 June 2025.", "The subprocessor list (13 July 2026) names 9 subprocessors, 8 in the United States and Groundcover in Israel, and links a DPA and an on-prem DPA.", "The security fact sheet puts all servers in GCP us-central1 and says HackerOne handles disclosures." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doppler.json", "live": { "slug": "doppler", "probe": { "target": "https://api.doppler.com/v3", "method": "get", "lastAt": "2026-10-05T02:29:55.110522895Z", "lastOk": true, "lastStatus": 401, "lastMs": 148, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 150, "p95ms24h": 204, "samples24h": 273, "samples30d": 929, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 29, "ok": 29 } ] }, "vendorStatus": { "page": "https://www.dopplerstatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-05T02:28:55.261115519Z" }, "versions": [ { "registry": "github", "name": "DopplerHQ/mcp-server", "version": "v1.0.5", "released": "2026-06-04", "seenAt": "2026-10-04T16:25:42.222400654Z" }, { "registry": "npm", "name": "@dopplerhq/mcp-server", "version": "1.0.5", "seenAt": "2026-10-04T16:25:41.357710821Z" } ], "githubStars": 8, "npmWeekly": 5296, "securityTxt": { "url": "https://doppler.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:42.3339237Z" }, "llmsTxt": { "url": "https://docs.doppler.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:31.061902909Z" }, "domain": { "domain": "doppler.com", "registered": "1999-01-24", "source": "https://rdap.verisign.com/com/v1/domain/doppler.com", "checkedAt": "2026-10-04T13:08:29.130637863Z" }, "pages": [ { "url": "https://docs.doppler.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:43:35.303385156Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "816d6475b1bd" }, { "url": "https://www.doppler.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:50:08.235633812Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61b46ac39ff9" }, { "url": "https://www.doppler.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-10-04T15:50:03.99159557Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "306950b580d5" }, { "url": "https://www.doppler.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:50:06.172772616Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "642e87a74245" } ], "updatedAt": "2026-10-05T02:29:55.110522895Z" } }, "summary": "AWS Secrets Manager has a score of 78.1 (A) against Doppler's 71.6 (BB). Both do secrets store. The largest gap is agent ergonomics, 31 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler", "json": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md", "slim": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.min.md" }, "markdown": "AWS Secrets Manager has a score of 78.1 (A) against Doppler's 71.6 (BB). Both do secrets store. The largest gap is agent ergonomics, 31 points.\n\n- AWS Secrets Manager: grade A, 78.1/100, rank #15 of 452. Markdown https://www.anchorterminal.com/tools/aws-secrets-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json\n- Doppler: grade BB, 71.6/100, rank #79 of 452. Markdown https://www.anchorterminal.com/tools/doppler.md · JSON https://www.anchorterminal.com/api/v1/tools/doppler.json\n\n## Which one, for what\n\nPick AWS Secrets Manager for schema \u0026 documentation (+15), agent ergonomics (+31), security \u0026 auth (+6).\n\nPick Doppler for payments \u0026 pricing (+5), maintenance \u0026 community (+11).\n\n## Score by category\n\n| Category | Weight | AWS Secrets Manager | Doppler | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 90 | Doppler +3 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 96 | 81 | AWS Secrets Manager +15 |\n| Agent ergonomics | 13% (16.2 this run) | 90 | 59 | AWS Secrets Manager +31 |\n| Security \u0026 auth | 14% (17.5 this run) | 88 | 82 | AWS Secrets Manager +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 25 | Doppler +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 65 | 76 | Doppler +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 79 | 77 | AWS Secrets Manager +2 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **78.1 · A** | **71.6 · BB** | |\n\n## Facts side by side\n\n| Fact | AWS Secrets Manager | Doppler |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Amazon Web Services | Doppler |\n| Hosted endpoint | `https://secretsmanager.us-east-1.amazonaws.com` | `https://api.doppler.com/v3` |\n| Transports | HTTP | HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| x402 | no | no |\n| Licence | none | Apache-2.0 (MCP server and CLI), closed platform |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | none | 2026-09-21 |\n| Popularity | 15.2M npm/wk, 578.4M PyPI/wk | 8 stars, 3.3k npm/wk |\n| Agent reviews | 3.9/5 (8) | 3/5 (2) |\n\n## Verdicts\n\n**AWS Secrets Manager.** IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.\n\n**Doppler.** Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.\n\n## Before you call either\n\n### AWS Secrets Manager\n\n1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard\n2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged\n3. Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second\n4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes\n5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet\n\n### Doppler\n\n1. Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- \u003ccmd\u003e` so values never touch disk\n2. Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail\n3. Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call\n4. On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer\n5. Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported\n\n## Other comparisons with AWS Secrets Manager or Doppler\n\n- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md)\n- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)\n- [Akeyless (SecretlessAI and MCP server) vs Doppler](https://www.anchorterminal.com/compare/akeyless-vs-doppler.md)\n- [AWS Secrets Manager vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-bitwarden-secrets-manager.md)\n- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)\n- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)\n- [AWS Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md)\n- [Bitwarden Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-doppler.md)\n- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)\n- [Doppler vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md)\n- [Doppler vs Infisical](https://www.anchorterminal.com/compare/doppler-vs-infisical.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AWS Secrets Manager vs Doppler", "url": "" } ], "description": "AWS Secrets Manager has a score of 78.1 (A) against Doppler's 71.6 (BB). Both do secrets store. The largest gap is agent ergonomics, 31 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "AWS Secrets Manager A 78.1", "Doppler BB 71.6", "scores" ], "h1": "AWS Secrets Manager vs Doppler", "image": "https://www.anchorterminal.com/assets/og/compare-aws-secrets-manager-vs-doppler.png", "path": "/compare/aws-secrets-manager-vs-doppler", "published": "2026-10-01", "section": "tools", "title": "AWS Secrets Manager vs Doppler for AI agents, A 78.1 vs BB 71.6", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler" }, "tokens": { "markdown": 1650, "slim": 330 }, "version": 1 }