Where and how best to store confidential data for project deployment?

Question

git

The project code is stored in a private git repo. Keys and passwords from third-party services with which the project interacts (AWS, Robokassa, Paypal, Stripe) are outside the repo - so far on my local laptop in 1Password, for example. In the project, all private data ends up in environment variables, and scripts take it from there. For Laravel, this is either through creating .env.php at the root of the project, or through the web server configs or settings when starting the docker container.
During deployment, SSH keys and keys from DigitalOcean are also required.
Tasks now:

1. With zero manual intervention deploy new servers with the project
   
2. Attract third-party developers to whom production keys should not be shown. There is a separate set of keys for development/testing.
   

Question: how and where is it better to store and update the keys, and how to pull them out when deploying the project, without giving third-party developers access to them? Ie, apparently, there should be one authorization point - for example, when running a script that opens access to a certain repository with keys and deploys a new server with a project. You want to keep the keys themselves separately from the deployment scripts.

Answer 1

Hashicorp Vault
or Ansible Vault
Despite the coincidence of names, these are fundamentally different things.

Answer 2

Divide / separate / clearly limit powers.
A small service that manages the key, for example, and the rest do not have access to keys, but only access this service. And he only allows them to do what they can.
Or see an example of how CloudFlare KeyLess works.

Answer 3

environment variables

$ cat .env
varname1=123
varname2=234

#!/bin/bash

echo Vars import to env
export $(cat .env | xargs)

www.stackoverflow.com/a/20909045