how do you manage secrets across microservices?

we're setting up a new microservices architecture and i'm trying to figure out the best way to handle sensitive info like api keys and database credentials. should we be injecting them at runtime, using a centralized secrets manager, or something else entirely? what strategies have worked well for you, especially in terms of security and ease of management