Secrets management
Each provider is profiled from its own documentation, with the source recorded against every figure. Whether a store can issue a credential that expires on its own, rather than one you rotate by hand, is the question that separates a vault from an encrypted key-value store.
| Provider | Entry paid plan | Secrets included | Dynamic secrets |
|---|---|---|---|
| AWS Secrets Manager | $0.40 per secret per month, plus $0.05 per 10,000 API calls. | Not documented | Not documented |
| Doppler | Team plan: $21/month per user, with a 14-day free trial. | Not documented | Not included on Developer or Team. Available on Enterprise. |
| Infisical | Pro tier: $20/identity/month billed annually, or $23/identity/month billed monthly. | Not documented | Not included on Free or Pro. Included from Advanced: dynamic secrets. |
Which to consider
Teams already deep in AWS IAM, Lambda and RDS — the integration is native rather than bolted on, and the per-secret price is simple to reason about.
Teams whose secrets access is dominated by CI/CD and service identities rather than human users — those ride free, so cost tracks headcount, not automation volume.
Teams that want per-identity pricing that treats a machine credential the same as a human one, or that value the option to self-host the same open-source engine the cloud product runs.