Bitwarden Secrets

Bitwarden Secrets Manager extends the trusted Bitwarden brand into developer secrets management beyond passwords — with machine service accounts, project-level permissions, and a secrets injection API suitable for CI/CD pipelines and agent runtimes. The open-source nature (BSL license) and self-hosting option give it a credibility advantage over less established secrets platforms. Confidence is docs-derived.

REST API at vault.bitwarden.com/api (Cloud) or self-hosted equivalent. CLI: bws secret get {id}, bws secret list --project-id {id}. SDK: official Python, Node.js, Go, Java, Ruby, C# clients. Secrets organized into Projects; access controlled per project via service account permissions. Secret fields: key, value, note, projectId. API: GET /secrets/{id}, POST /secrets (create), PUT /secrets/{id} (update).

Access token auth: BITWARDEN_ACCESS_TOKEN environment variable or passed explicitly to SDK. Machine service accounts generate access tokens with project-level scopes. HTTPS enforced. Bitwarden uses end-to-end encryption — server never sees plaintext secret values (zero-knowledge). Tokens are short-lived with configurable expiry. Rotate tokens via Bitwarden Console.

SDK failures (network, invalid token) surface as exceptions; handle gracefully in application startup. Access token expiry is the primary operational concern — implement token refresh or use long-lived tokens for CI/CD contexts. Bitwarden Cloud uptime at bitwarden.statuspage.io. Self-hosted: operator responsible for Vaultwarden/Bitwarden Server uptime.

bitwarden.com/help/secrets-manager covers getting started, service account setup, SDK reference, and self-hosting. SDKs for all major languages reduce integration complexity. bws CLI is useful for shell scripts and CI pipelines. Free tier: 3 service accounts, 100 secrets per organization (Secrets Manager pricing separate from Password Manager). Community via Bitwarden Community forums and GitHub.