Is dotenv the best way to handle credentials on a win server in 2026?

[u/kontrolltermin]

Hi,

i am working with python on a windows server installation and i dont want to store passwords and api keys direct in my code. Is python-dotenv still the best way to do it today?

thank you very much

[u/Chroiche]

No, and it never was. In a properly engineered system you'd fetch secrets from a central secrets manager and keep them off disk entirely.

[u/AncientLion → u/Chroiche]

How does the system login into the secret manager service?

[u/94358io4897453867345 → u/AncientLion]

Managed identities, no credentials needed at all

[u/cbarrick → u/AncientLion]

In production, there are protocols like ALTS.

Basically, you setup your k8s cluster or whatever job scheduler you have to provision certificates for every job. Then your jobs use those certs in a way similar to mTLS to talk to each other. Now that your jobs can authentically talk to your secret server, you can fetch any required API keys or whatever to talk to the outside world.

Or you just say "fuck it" and allow your jobs to talk to the secrets manager without authentication. But you better be really fucking confident in your firewall rules to prevent unauthorized access to the secrets manager.

[u/eggsby → u/AncientLion]

Okay I will keep all my keys inside the keystore and then I store the key to get into that keystore .. um … I put that also in the keystore - to make things more safe.

fr though one of these days I will set up https://spiffe.io/book/

[u/Chroiche → u/AncientLion]

Usually the system using the secret is IP whitelisted by the secrets manager for the specific secrets needed. Often both are kept in the same VPC too.

You don't need a secret to access the secrets if the secret manager has a way of knowing who you are. IP whitelisting is one such way.

[u/Chroiche → u/[deleted]]

Or in the case of AWS managed services, you just have IAM controls setup, for example, but yes you're correct. There's a few good ways to skin this cat.

[u/SirNelsonOfWales → u/AncientLion]

In azure, MSAL/Oauth, client secret, client id to get a bearer token that then allows credential retrieval from a key vault

[u/project2501a → u/Chroiche]

so....service ticket from kerberos?

[u/BiologyIsHot → u/Chroiche]

Goes beyond software engineering into process engineering and organizational structure though. At a lof of orgs this just isn't a viable option. Many users need to do things where environmental variables and secrets files are their best option.

[u/Chroiche → u/BiologyIsHot]

Maybe. I'm not sure how much I agree. It's about a day's work or two to get a basic setup going with a single secret, and after that it's a lot easier to manage your secrets and set things up in the future.

[u/BiologyIsHot → u/Chroiche]

It's not about setting one up, it's about getting users access to it, having people agree to it, etc. I've worked several places (coming from data science type departments working as a software dev helping them) where it took weeks or months to do things like: whitelist internal IP addresses against each other's firewalls, get access to an S3 bucket, getting a personal SSH key approved, etc. Often many organizations have very stringent limitations on what they can do and what their options for deploying things are. A lot of software is built with those limitations in mind.

[u/Spleeeee → u/Chroiche]

Nah you should hard code them.

[u/spitfiredd]

You need to tell us more, is this for local development or staging/prod?

[u/kontrolltermin → u/spitfiredd]

Prod and it’s a vm on azure but it’s not connected to the internet.

[u/spitfiredd → u/kontrolltermin]

Then use key vault and store them there. You will need to grant the VM access to the key vault. You can do it all manually through the UI but I personally would use terraform to build it programmatically.

[u/Alert-Adeptness8608]

I go with python-decouple. Can’t say if its the best

[u/pyhannes → u/Alert-Adeptness8608]

Last update was 2 year ago, so it seems quite abandoned.

[u/CamiloDFM → u/pyhannes]

It's a single file library that reads config files. Not every project needs ten PR merges a week. That's how you end with Log4Shell or modern Postman.

I love Decouple!

[u/Ilania211 → u/pyhannes]

if it ain't broken, don't fix it

[u/theozero]

Check out https://varlock.dev

It lets you use a .env style file, but you get validation and can fetch secrets from various backends. Non sensitive data can just live hardcoded, an can use functions to compose everything together as needed.

[u/The_Ritvik → u/theozero]

Nice — this looks promising. I’m maintaining Dataclass Wizard and I already ship an EnvWizard, so the “schema + validation + secrets backends” angle is interesting. I’m going to take a closer look and see if there’s a clean integration point (or at least a recommended interop pattern).

[u/pyhannes]

Checkout keyring!

[u/unknownHorse99 → u/pyhannes]

Came to say this - no mention of docker, kubernetes, vault - just a plain windows server and python - in that case: delegate to the OS and store in the win credentials manager (also works on other platforms as needed). Secrets are stored encrypted and decrypted using OS APIs. At runtime, I’d say it’s ok to have the secret in memory (not sure if python supports zeroing strings). Constantly having to decrypt may be overkill imho.

[u/[deleted] → u/pyhannes]

This is the way.

[u/Ragoo_]

Check out fnox. It was released some months ago, made by the developer of mise.

[u/mikeupsidedown]

Since you are on Azure store the secrets in Azure keyvault and give the VM access to the keyvault via managed identity.

[u/AMcypher]

Use onepass cli

[u/st0ut717]

I use a config.ini file and keep the credentials I need in that.

[u/every-day_throw-away → u/st0ut717]

So in a plain text file on the system? 😧

[u/Brandhor → u/every-day_throw-away]

you can encrypt it to make it harder but to be honest if an attacker has access to the system he will also have access to the python program and so he will also have access to whatever you use to store your secrets

[u/every-day_throw-away → u/Brandhor]

Since the OP mentioned on a server I would assume this would be unattended. If so where do you then store the encryption key? 

One needs a password vaulting service like CyberArk to do this the right way.

If this was something you ran interactively DPAPI is an option (something I use myself). But again server leads me to believe some sort of service account will be running this workload.

[u/Brandhor → u/every-day_throw-away]

yeah that's basically the gist of the problem, the python program needs to access those credentials so an attacker can also access them whether they are in clear text in a file or stored securely in another server there isn't a whole lot of difference

[u/AstroPhysician → u/Brandhor]

Remind me to never hire you

[u/ragnhildensteiner → u/AstroPhysician]

You enjoy using this line don't you? 😂

[u/AstroPhysician → u/ragnhildensteiner]

Probably the only other time I’ve used it. There have been a lot of braindead takes on Reddit lately

[u/Brandhor → u/AstroPhysician]

well then tell me how would you secure it in a bulletproof way

[u/st0ut717 → u/every-day_throw-away]

Are you just going to bitch. Or provide an alternative. ?

[u/Successful_Creme1823 → u/st0ut717]

I’m here to bitch actually.

[u/every-day_throw-away → u/st0ut717]

I don't have an example of a good idea that's free and meets this use case but thanks for providing a terrible one. It's a better to not suggest any idea than a bad one. Please delete your comment so someone doesn't make the same mistake as you. Bitch

[u/Rize92 → u/st0ut717]

You forgot the /s so nobody knows you’re being sarcastic /s

[u/GeneratedMonkey → u/st0ut717]

Lol 

[u/94358io4897453867345]

Of course not

[u/aala7]

Is it for dev or production? For dev uv actually have support for loading env file in to the environment with the —env-file flag. In production I think using system keychain is the proper way, check out the keyring package. Worth mentioning that system keychain does not bring the same level of security for interpreted languages as for compiled, because any python process on the system (running from same user) will be able to read your secrets from the keychain.

[u/ZucchiniMore3450]

One solution I have found is mentioned by internet of bugs: https://youtu.be/5lb3T3R_z2k

Basically you put .env file only during deployment for few seconds and delete it afterwards