1# Key Vault Secrets — Java SDK Quick Reference
2 
3> Condensed from **azure-security-keyvault-secrets-java**. Full patterns
4> (async client, secret rotation, backup/restore, config loader)
5> in the **azure-security-keyvault-secrets-java** plugin skill if installed.
6 
7## Install
8```xml
9<dependency>
10    <groupId>com.azure</groupId>
11    <artifactId>azure-security-keyvault-secrets</artifactId>
12    <version>4.9.0</version>
13</dependency>
14<dependency>
15    <groupId>com.azure</groupId>
16    <artifactId>azure-identity</artifactId>
17</dependency>
18```
19 
20## Quick Start
21 
22> **Auth:** `DefaultAzureCredential` is for local development. See [auth-best-practices.md](../auth-best-practices.md) for production patterns.
23 
24```java
25import com.azure.security.keyvault.secrets.SecretClientBuilder;
26import com.azure.identity.DefaultAzureCredentialBuilder;
27var secretClient = new SecretClientBuilder()
28    .vaultUrl("https://<vault>.vault.azure.net")
29    .credential(new DefaultAzureCredentialBuilder().build())
30    .buildClient();
31```
32 
33## Best Practices
34- Enable soft delete — protects against accidental deletion
35- Use tags — tag secrets with environment, service, owner
36- Set expiration — use `setExpiresOn()` for credentials that should rotate
37- Content type — set contentType to indicate format (e.g., application/json)
38- Version management — don't delete old versions immediately during rotation
39- Access logging — enable diagnostic logging on Key Vault
40- Least privilege — use separate vaults for different environments
41