Single Sign On (SSO) for all applications as the default. That will do 80%+ of what you want. Thycotic (Delinea) Secret Server for API keys, break-glass account

Single Sign On (SSO) for all applications as the default. That will do 80%+ of what you want. Thycotic (Delinea) Secret Server for API keys, break-glass accounts, etc. If you have a more granular need for Privileged Access Management (PAM) there are enterprise tools for that. (I don't recommend BeyondTrust; I've heard CyberArk is decent but haven't used it.) You could do a mid-roll-your-own with Bitwarden commercial, etc., though consider the operational management overhead.