> ## Documentation Index
> Fetch the complete documentation index at: https://bruno-a6972042-mintlify-c74cb75a.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Integrating HashiCorp Vault
export const PremiumBadge = ({noLink}) => {
const badge =
PREMIUM
;
if (noLink) {
return badge;
}
return
{badge}
;
};
Bruno allows you to integrate:
* [HashiCorp Cloud Vault ↗](https://developer.hashicorp.com/hcp)
* [Vault Enterprise Server ↗](https://developer.hashicorp.com/vault/docs/enterprise)
* [Local Vault server ↗](https://developer.hashicorp.com/vault/docs/install)
as your secret provider. You can configure the secret provider from the **Preferences** settings in the **Secrets Manager** section.
## Setting Up Vault Server
To configure a **Vault server** secret provider, you can opt for either **Token** or **AppRole** authentication.
1. Go to the **Preferences** settings and navigate to the **Secrets Manager** section.
2. Click on the `+ Add Secret Manager` button.
3. Select **HashiCorp Vault Server** as the provider type and choose an authentication method:
* **Token** - authenticate using a static Vault token. Simplest to set up; suitable for local development and trusted environments.
* **App Role** - authenticate using a Role ID and Secret ID pair. Recommended for automated pipelines and CI/CD where a personal token is not appropriate.
* **LDAP** - authenticate using an LDAP username and password. Use when your Vault instance is backed by an LDAP/Active Directory identity provider.
4. Enter `http://localhost:8200` if using a local server, or the URL of the hosted server (e.g., `https://vault.example.com`).
5. Provide the necessary [Token ↗](https://developer.hashicorp.com/vault/docs/commands/token) or [AppRole ↗](https://developer.hashicorp.com/vault/tutorials/auth-methods/approle) credentials.
6. Click on **Add** to save the secret provider.
Click on **Test Connection** to verify the connection to the Vault server.
## Setting up Vault Cloud
To set up a **HashiCorp Vault Cloud** secret provider, follow these steps:
1. Go to the **Preferences** settings and navigate to the **Secrets Manager** section.
2. Click on the `+ Add Secret Manager` button.
3. Select **HashiCorp Vault Cloud** as the provider type.
4. Maintain the default settings for `Token Endpoint` and `Secrets Endpoint`, or modify them if necessary.
5. Provide the required [Client Credentials ↗](https://developer.hashicorp.com/hcp/docs/hcp/admin/iam/service-principals).
6. Add one or more Projects (Apps) to the secret provider.
7. Click on **Add** to save the secret provider.
## Exporting as a .env file
Once a provider is saved, you can export its configuration as a `.env` file directly from **Preferences** > **Secrets Manager**. This is useful for sharing credentials with the Bruno CLI or seeding a CI/CD pipeline without manually transcribing values.
1. In the **Secrets Manager** list, hover over the account you want to export.
2. Click the **Export as .env** icon (the square-with-arrow icon on the right).
3. Bruno writes the credentials to a `.env` file on your machine.
The exported `.env` file contains your vault credentials in plain text. Add it to `.gitignore` immediately and never commit it to version control.
Pass the exported file to the CLI using the `--secrets-env-file` flag:
```bash theme={null}
bru run collection/ --env Production --secrets-env-file ./secrets.env
```
See [Secret Managers in Bruno CLI](/bru-cli/secret-managers) for full credential file formats and usage.