Secrets Management Basics

How should services obtain database passwords and API keys in production (vs committing .env to git)?

Answers use simple, clear English.