The two designs
| Property | .env file | Key vault |
|---|---|---|
| Where the key lives | On every machine, in plain text | Encrypted, on the platform |
| What the agent holds | The key itself | A revocable device token |
| Sharing with a team | Copy the file around | Grant access per member |
| Revoking one person | Rotate the key for everyone | One click, nobody else notices |
| Leak blast radius | The key, everywhere it was copied | A token you can kill in seconds |
Where a .env is honestly fine
One machine, one person, nothing committed, no agent with shell access — a .env works and costs nothing. The problems start with the second machine, the first teammate, or the first time the agent runs tools that could read or print files.
Where the vault wins
The agent never sees the key, so there is nothing for a prompt-injection attack or a buggy tool to exfiltrate — the argument laid out in API key security. And because access is per member, team key sharing stops being a game of forwarding secrets.
The deciding question
Ask one question: when this key leaks, do I rotate once, or do I hunt down every copy? If the answer is “hunt”, move to the vault — see how the free key agent works and how revocation works in practice.