A Solo DevOps Consultant's Case for Doppler Over Vault

Once you're holding credentials for more than one client, yes, even if each engagement is small. The risk isn't complexity, it's mixing up which client a credential belongs to, or forgetting to revoke access to a project you finished months ago. A lightweight vault solves that even for a single consultant working alone.

Vault needs a storage backend, an unsealing process, and someone watching for when a certificate or token needs renewal, none of which disappears just because you're the only person using it. For a consultant billing by the hour, the setup and upkeep time comes directly out of billable capacity, and a client rarely wants to pay for infrastructure supporting your own operations rather than theirs.

Doppler's hosted model means there's no server to patch and no unsealing process to remember. You create a project per client, invite the client's own team if they need visibility, and sync variables to whatever CI or hosting platform that engagement uses. The setup for a new client takes minutes rather than an afternoon.

A client inheriting a Doppler project is a straightforward ownership transfer: they take over billing and access, and their credentials go with the project. Handing over a Vault instance you stood up for them is a bigger ask, because now the client needs someone who can operate Vault itself, which is a bigger commitment than most small clients are prepared to make.

If a client's own engineering team grows past what a lightweight tool comfortably supports, or their compliance obligations require dynamic, short-lived database credentials, recommending Vault to them is the right call, even if you personally continue working in Doppler for your own smaller engagements. The decision should track the client's needs, not a preference for one tool everywhere.

Introduce Vault when a client's situation matches one of these:

• The client's own engineering team has grown past what a lightweight tool comfortably supports.
• Their compliance obligations require dynamic, short-lived database credentials rather than standing passwords.
• Someone on their side can actually operate Vault itself, since handing over an instance nobody can run is a poor outcome.
• Your own smaller engagements can stay on Doppler, because the recommendation should follow the client's needs and not a tool preference.

Working across several clients in the same afternoon, it's easy for a solo consultant to run a command against the wrong client's infrastructure simply because the terminal session from the last engagement is still the active one. This is less a secrets management problem than a working-habits problem, but the two compound each other: a shared local .env file makes the mistake easier to make in the first place.

Doppler's CLI helps here by naming the active project in your shell prompt when you run a command through it, giving you a visual check before you execute anything destructive. Getting into the habit of running doppler run inside a dedicated terminal tab per client, rather than switching contexts inside one shared tab, removes most of the risk of this kind of mix-up.

A password manager works fine for a single client with a handful of credentials that rarely change. The moment you're syncing the same variable into more than one place, a CI pipeline and a hosting platform, for example, a password manager stops being enough, because it has no mechanism to push an updated value anywhere; you're still the one manually copying it.

A reasonable rule: once a client's setup involves more than two systems that need the same credential kept in sync, move that client onto Doppler rather than continuing to manage it by hand. Below that threshold, the overhead of a dedicated tool probably isn't worth it yet for a single engagement.

As a one-person shop, you're the only person who can grant or revoke access to most of your clients' systems, which means a client's continuity depends on your availability. If you're unreachable for a week, whether from illness or simply being offline, a client who needs an emergency credential change has nowhere to turn.

Give each client a documented way to reach a backup, even if that's just another freelancer you trust who knows where your password manager or Doppler account lives and has a signed agreement covering emergency access only. Write down, somewhere the client can find it without you, which tool holds their secrets and who else can act on them if you can't.

This is less about the tool and more about the plan. A solo consultant using Doppler with no emergency access plan is in a weaker position than one using a plain password manager with a clear one.