Azure Key Vault

az keyvault create \
  --name "authscape-vault" \
  --resource-group "authscape-rg" \
  --location "eastus"

az keyvault secret set \
  --vault-name "authscape-vault" \
  --name "ConnectionStrings--DefaultConnection" \
  --value "Server=..."

az keyvault secret set \
  --vault-name "authscape-vault" \
  --name "AppSettings--Stripe--SecretKey" \
  --value "sk_live_xxx"

dotnet add package Azure.Extensions.AspNetCore.Configuration.Secrets

var builder = WebApplication.CreateBuilder(args);

if (!builder.Environment.IsDevelopment())
{
    var keyVaultUri = builder.Configuration["KeyVault:Uri"];

    builder.Configuration.AddAzureKeyVault(
        new Uri(keyVaultUri),
        new DefaultAzureCredential()
    );
}

builder.Configuration.AddAzureKeyVault(
    new Uri("https://authscape-vault.vault.azure.net/"),
    new DefaultAzureCredential()
);

builder.Configuration.AddAzureKeyVault(
    new Uri("https://authscape-vault.vault.azure.net/"),
    new ClientSecretCredential(
        tenantId: "your-tenant-id",
        clientId: "your-client-id",
        clientSecret: "your-client-secret"
    )
);

# For Managed Identity
az keyvault set-policy \
  --name "authscape-vault" \
  --object-id "<managed-identity-object-id>" \
  --secret-permissions get list

# For Service Principal
az keyvault set-policy \
  --name "authscape-vault" \
  --spn "<client-id>" \
  --secret-permissions get list