how do you handle api secrets when you've got multiple services talking to each other?

hey everyone, ive been wrestling with how to securely share api keys and other secrets between different microservices in our system. right now, were passing them around in environment variables, but that feels pretty risky, especially with multiple environments (dev, staging, prod). has anyone found a good pattern or tool for managing this? thinking about dedicated secret management tools, but curious what others are doing in practice. whats your experience been