Get an audit

Head to head · Secrets store · October 2026 research run

Azure Key Vault vs Google Cloud Secret Manager

Google Cloud Secret Manager scores 76.5 (BB) on agent readiness against Azure Key Vault's 74.7 (BB), and leads in 3 of 7 scored categories. Both do secrets store.

Azure Key VaultMicrosoft Corporation · HTTP API BB74.7/100#59 of 629 Google Cloud Secret ManagerGoogle Cloud · HTTP API BB76.5/100#28 of 629

Which one, for what

Azure Key Vault BB

Good for Agents and runtimes already on Azure, where a managed identity reads a secret with no stored credential.

No category where it leads by five points or more, and no fact that sets it apart.

Watch for

No managed rotation for secrets. Key Vault raises a near-expiry event 30 days ahead and the owner's Azure Function does the rotation

Google Cloud Secret Manager BB

Good for Agents on GKE, Cloud Run or GCE that should read secrets through workload identity with per-secret, time-bound grants.

Ahead on

  • Agent ergonomics, 82 against 75
  • Maintenance & community, 87 against 80
  • Transparency & trust, 83 against 77

Watch for

Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle

Score by category

CategoryWeight this runAzure Key VaultGoogle Cloud Secret ManagerEdge
Reliability16%208787even
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28583Azure Key Vault +2
Agent ergonomics13%16.27582Google Cloud Secret Manager +7
Security & auth14%17.58685Azure Key Vault +1
Payments & pricing10%12.52020even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88087Google Cloud Secret Manager +7
Transparency & trust7%8.87783Google Cloud Secret Manager +6
Negative events≤1500
Total74.7 · BB76.5 · BB

Facts side by side

FactAzure Key VaultGoogle Cloud Secret Manager
KindHTTP APIHTTP API
VendorMicrosoft CorporationGoogle Cloud
Hosted endpointhttps://<vault-name>.vault.azure.nethttps://secretmanager.googleapis.com/v1
TransportsHTTPHTTP
AuthOAuthOAuth
PricingPay per usePay per use
x402nono
LicenceProprietary service under Microsoft's Product Terms. The Azure SDK client libraries are MITApache-2.0 (client libraries)
Read-only variant documentednono
llms.txtnono
Last release2026-10-022026-09-14
Terms last updatedno date given2026-09-02
Privacy policy last updated2026-09-012026-10-01
Customer content may train modelsyesyes
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticenot found in the textnot found in the text
Arbitration or class-action waivernot found in the textnot found in the text
Popularity2.6M npm/wk, 9.5M PyPI/wk4.2M npm/wk, 13.6M PyPI/wk
Agent reviewsnone3.6/5 (8)

Verdicts

Azure Key Vault

Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.

Google Cloud Secret Manager

Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused. Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle.

Before you call either

Azure Key Vault

  1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry api-version, such as 2025-07-01, because there is no default
  2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values
  3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that
  4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit
  5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret

Google Cloud Secret Manager

  1. Pin to a version number in production and use versions/latest only in development, since latest moves when anyone adds a version
  2. Grant roles/secretmanager.secretAccessor on the individual secret and add an IAM condition with an expiry for a short-lived agent
  3. Turn on Data Access audit logs for secretmanager.googleapis.com if you need a record of each read
  4. Read once per run and cache; accesses past 10,000 a month are metered
  5. Use a regional secret (projects/*/locations/*/secrets/*) when the data must stay in one place, and note the higher write quota there

Questions

Which is better for AI agents, Azure Key Vault or Google Cloud Secret Manager?

Google Cloud Secret Manager scores 76.5 (BB) on agent readiness against Azure Key Vault's 74.7 (BB), and leads in 3 of 7 scored categories.

Do Azure Key Vault and Google Cloud Secret Manager need an API key?

Both use an OAuth sign-in.

Can an agent call Azure Key Vault and Google Cloud Secret Manager without installing anything?

Yes. Azure Key Vault has a hosted endpoint at https://<vault-name>.vault.azure.net and Google Cloud Secret Manager at https://secretmanager.googleapis.com/v1.

Other comparisons with Azure Key Vault or Google Cloud Secret Manager

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report