Secret Manager — Vault

Adds a HashiCorp Vault backend to the Secrets extension, so your API keys and tokens are stored in Vault instead of on your machine. Install it when your team already keeps credentials in Vault.

What you can do

• Store, view and delete secrets in HashiCorp Vault, using Vault's KV v2 (key-value) secrets engine.
• Connect to a Vault server with its address, an optional namespace, the KV v2 mount and an access token. The token is checked when you connect.
• Let your other extensions read those secrets when they need them.

Getting started

1. Open the Secrets extension.
2. Click +, choose HashiCorp Vault…, and fill in the store name, Vault address, KV v2 mount and Vault token. Secrets: Connect HashiCorp Vault in the command palette opens the same form.
3. Add and reference secrets as usual. They are read from and written to Vault.

Requirements

• The desktop app.
• The Secrets extension, which draws the sidebar and the list.
• A reachable Vault server with a KV v2 mount, and a token allowed to read, write and delete on it.

Settings

You can set a default Vault address and a default mount, which prefill the connect form.

Good to know

• The Vault token is kept in Studio's encrypted secret store on this machine, never in a project file.
• When an AI assistant or a flow reads, writes or deletes a secret, the request goes through the approval rules.
• Deleting a secret destroys only its latest version in Vault. Earlier KV v2 versions stay readable there, so deleting a leaked credential here does not remove it from Vault.
• If Vault cannot be reached when you delete, the secret leaves the list but stays in Vault.