---
title: Secrets Manager Features
description: Features of DigitalOcean Secrets Manager.
product: Secrets Manager
url: https://docs.digitalocean.com/products/secrets-manager/details/features/
last_updated: "2026-11-03"
---

> **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document).

# Secrets Manager Features

DigitalOcean Secrets Manager provides a central place to store and manage sensitive values used by applications running on DigitalOcean.

DigitalOcean Secrets Manager stores named secrets that you create and manage in the DigitalOcean Control Panel or with doctl. Each secret can contain one or more key-value pairs. For example, a database secret can contain separate keys for:

- `username`
- `password`
- `host`
- `port`

Secret values are masked in the Control Panel after they are stored.

## Regional Secrets

Create each secret in a supported DigitalOcean region. The secret remains associated with the region selected during creation.

## Immutable Versions

Secrets Manager creates an immutable version when a secret is created or updated. Versioning allows you to:

- Update values without changing the secret name.
- Identify the current version.
- Retrieve a retained version by its version number.
- Revert to a retained version through the Control Panel or the API.
- Maintain a history of the five most recent versions.

Reverting copies the values from the selected version into a new version, which then becomes active. You cannot delete individual versions. Deleting a secret soft-deletes the secret and all of its retained versions, and you can restore it within 7 days.

## DigitalOcean Control Panel

Use the DigitalOcean Control Panel to:

- View secrets available to your team.
- Create and update secrets.
- Select the secret’s region.
- Add multiple key-value pairs.
- View the current version.
- View up to five retained versions.
- Revert to a retained version.
- Delete a secret.

## Command-Line Access

Use doctl to:

- Create secrets.
- Supply multiple key-value pairs.
- Create secrets interactively.
- Create secrets from environment files.
- List and retrieve secrets.
- Update and delete secrets.
- List retained versions.
- Manage individual key-value pairs.

Secrets Manager commands require doctl 1.164.0 or later. For the full command syntax, see the [`doctl secrets` reference](https://docs.digitalocean.com/reference/doctl/reference/secrets/index.html.md).

## API Access

Use the [Secrets Manager API](https://docs.digitalocean.com/reference/api/reference/security/index.html.md) to integrate secret management into applications and automated workflows. The API supports managing secrets, retrieving retained versions by version number, and reverting to a retained version.

## Stable Application References

Applications reference a secret by name rather than embedding its value directly in application code or deployment configuration. This allows you to update sensitive values while keeping the application’s secret reference unchanged.

## Related Topics

- [Secrets Manager Overview](https://docs.digitalocean.com/products/secrets-manager/overview/index.html.md)
- [Manage Secrets in the Control Panel](https://docs.digitalocean.com/products/secrets-manager/how-to/console/index.html.md)
- [Manage Secrets with doctl](https://docs.digitalocean.com/products/secrets-manager/how-to/doctl/index.html.md)
- [Versions and Rotations](https://docs.digitalocean.com/products/secrets-manager/concepts/versions-and-rotations/index.html.md)
- [Secrets Manager Availability](https://docs.digitalocean.com/products/secrets-manager/details/availability/index.html.md)
- [Secrets Manager Limits](https://docs.digitalocean.com/products/secrets-manager/details/limits/index.html.md)