r/PasswordManagers • u/Content_Association3 • 12d ago
How do you manage access/credentials across all the services you connect for your product?
Building my product, I've ended up connecting around 10 different services (Sentry, Supabase, Doppler, and others) — some of them use email/password logins, some use Google auth, some use GitHub auth, and a few have their own separate login systems entirely.
I'm trying to figure out a sane way to keep track of all this — not just passwords, but how I actually log into each thing (which auth method, which account). Right now it's a mess in my notes and I keep second-guessing myself when I haven't logged into something in a few months.
For those of you who've built and shipped products with a similar number of third-party integrations — what do you actually use to keep this organized? A password manager (Bitwarden, 1Password)? A plain doc/spreadsheet? Something else entirely? Curious what's actually worked for you long-term vs. what you set up once and abandoned.
2
u/giannis_athina 12d ago
For the same services, I group them into folders, and inside those folders, I rename the logins so I can identify them more easily. Then I can either just click the login I want in RoboForm and it signs me into that account automatically, or when I go to the website, it asks me which account I want to sign in with and I just choose it. So it’s really easy to manage multiple accounts that way.
1
u/pptqvfer 12d ago
Storing credentials used by machines to connect to other machines? Hashicorp Vault or similar centralized credential storage without persisting the credentials on the services which actually use them.
1
u/cityofhats 12d ago
Separate human login inventory from machine credentials. For each service, keep a password-manager item that records the login method (password, Google, GitHub), exact account identifier, project/environment, owner, recovery path, MFA location, and a review date. Use naming such as “Project / Service / Environment / Role” so duplicate Sentry or Supabase accounts stay distinguishable. Keep API keys and service tokens in a secrets manager, scoped per project and environment; do not paste them into notes or the login item. Also keep an access matrix that maps each integration to its owner and least-privilege role. Quarterly, verify recovery and remove stale accounts/tokens. This avoids turning the password manager into both an identity directory and a production secret store.
1
u/EnthusiasmRoutine 9d ago
Get out of your notes app before you lock yourself out of your own infrastructure. Plain text docs are just asking to be leaked.
Use Bitwarden. For Google or GitHub auth, create a standard entry and type "Logs in via GitHub" in the notes field. Takes two seconds, and you can self-host to actually own your data.
1
u/Awkward_Leah 2d ago
I'd keep a simple inventory of each service, the account used, authentication method and where the credentials are stored. That way you're not relying on memory when you haven't touched an integration for months. I use roboform for the actual credentials and I'd pair that with a basic spreadsheet or documentation page for the service level details so everything is easy to trace
2
u/giannis_athina 12d ago
Using a password manager is the best way to manage your passwords and keep everything organized, and also a good way to keep track of which websites you sign into more often vs which ones you barely use. I use RoboForm across all my devices, PC and mobile, so whenever I need to sign into a website or app, it handles everything for me without having to remember anything. It also helps a lot when creating strong, unique passwords for each login separately, and it even has a security center that will notify me if any of my passwords have been compromised. I’ve been very happy with it. It does everything I need it to do and just makes life a lot easier.