The way that appsettings work in the DXP environment makes it extremely difficult to set secrets and keep them out of the appsettings.json files. For instance, we are dealing with many Optimizely products that require items like API Keys be added to the configuration. These kinds of values, often referred to as secrets, should never go in a plain text file like appsettings.json files or anything else that gets checked in to source control. It is good that DXP uses key vault, but guess what??? You cannot input any keys that start with EPiServer or Optimizely. I thought I would be slick and just add a prefix (like Secret_Optimizely) and then use .AddEnvironmentVariables("Secret_") so they would get added but have the Secret_ get removed. Nope.....they also do not allow single underscores.
I understand that Opti may want to control some Opti related configuration, but if they aren't going to allow it, they should have some avenue to get these in (whether through a service request or something else). Otherwise you are stuck with doing some really out of the way things to keep secrets safe, or you have to go against best practices and just put them in appsettings.json.
Thanks for the feedback! We are addressing this and the behavior will soon change to allow for the word 'Episerver' in keys. Progress can be followed through the feedback item https://feedback.optimizely.com/ideas/DXCS-I-431.