A dynamic secret is created on demand for one consumer and expires on its own. A static secret is created once and reused until someone rotates it. Prefer dynamic secrets where the target system supports them. Keep static secrets for systems that cannot issue credentials on request, and rotate them.
Definitions
Static secret. A fixed password, key or token. It stays valid until changed. Examples: a third party API key, a shared service password.
Dynamic secret. A credential generated when an application asks for it, with a lease that ends. OWASP describes the pattern: apps request credentials at startup, with short lease durations, and the credentials are revoked when no longer needed.
Comparison
| Question | Static | Dynamic |
|---|---|---|
| How long is it valid? | Until rotated | Until the lease ends |
| Blast radius if leaked | Large, often unnoticed | Small, expires soon |
| Who holds it? | Many people and systems | One consumer |
| Attribution in logs | Weak, shared | Strong, one per consumer |
| Works with any system? | Yes | Only if the target can issue and revoke |
| Operational effort | Rotation projects | Initial integration |
Two cautions from OWASP
First, restarting an application does not itself revoke stolen credentials. Revocation should follow lease expiry or an explicit revoke call, not the consumer shutting down.
Second, creating dynamic secrets often requires a long lived static secret somewhere. The vault needs an administrative credential to create database users. That one deserves the strongest protection you have. See our post on secret zero.
How to choose
- Does the target system support creating and deleting credentials through an API? If not, use static and rotate.
- Do many instances need access at once? Dynamic gives each its own credential, which helps attribution.
- Can your application cope with a credential changing while it runs? If connections cannot refresh, plan renewal or restarts.
- How costly is a leak? For production data stores, the answer usually favours dynamic.
Migrating step by step
- Pick one database or cloud role with a clear owner.
- Create a role template with the minimum permissions.
- Have the application request credentials at startup and renew before expiry.
- Alert on lease creation failures, which would otherwise become outages.
- Retire the old static credential after a quiet period.
For the static ones you keep, a dual credential rotation pattern avoids downtime.
Quick check
Do dynamic secrets remove the need for rotation?
They replace rotation with short expiry for the secrets they cover. Static secrets and the vault's own admin credentials still need rotation.
Are dynamic secrets always better?
No. If the target cannot issue credentials, or your app cannot handle changing ones, a well rotated static secret is the practical choice.
Safeguard's free scan can show you which static credentials are sitting in code today, a useful starting list.
Sources
Last reviewed: 19 October 2026.
