Secret Manager Integration: HashiCorp Vault

What It Does

Secret Manager Integration lets the platform borrow credentials without owning them. Rather than saving an API key or password in a test, you reference a secret in Vault and the platform retrieves it at execution time. Your security team keeps a single source of truth, rotation policies enforced in Vault apply to your tests automatically, and sensitive values never live inside test definitions or reports. References are resolved by the server runner in requests, OAuth 2.0 and sign-in-with-steps profiles, and JSON-RPC and WebSocket-RPC tokens; the local runner in the desktop app does not resolve them and says so by name. Vault connects with an address and a token, with an optional namespace, and a reference can pick one field or take the whole secret. Adapters for AWS Secrets Manager and Azure Key Vault are not offered yet.

Key Capabilities

How It Works

1. 1

   An administrator opens Settings → Integrations → Secret Managers and adds HashiCorp Vault

2. 2

   Test a secret path; the platform confirms it resolves without showing the value

3. 3

   Reference the secret as secretref://<provider>/<path>#<field> in a request or OAuth 2.0 profile

4. 4

   Run on the server runner; the current value is fetched in memory at run time

5. 5

   Rotate the secret in Vault and the next run picks up the new value