I use Doppler as my secrets manager, but this requires you to inject the Doppler secrets by running doppler run -- python app.py instead of python app.py for example. I'd really like to keep with Doppler since everything else is configured to use it and it's easy to update values if need be.