> **Postman Cloud Vault is an early access feature.** Your *Postman Vault* enables you to store sensitive data as vault secrets locally or in the Postman cloud and reuse them in your HTTP collections and requests. Your *Postman Local Vault* enables you to store vault secrets in your local instance of Postman, where only you can access and reuse values associated with your vault secrets. With a *Postman Cloud Vaults*, you can sync your vault secrets to the Postman cloud, enabling you to access and reuse your vault secrets across devices. Vault secrets synced to the Postman cloud are end-to-end encrypted. Learn more about your [local vault](#about-your-postman-local-vault) and [cloud vaults](#about-postman-cloud-vaults) in your Postman Vault. ![Add secrets to Postman Vault](https://assets.postman.com/postman-docs/v11/add-postman-vault-secrets-cloud-v11-27-b.jpg) > **Important**: This guide links to documentation that may mention vault secrets in your Postman Vault can only be reused in your local instance of Postman, vault secrets aren't synced to the Postman cloud, and vault secrets are deleted after signing out of Postman. These details only apply to vault secrets stored in your [local vault](#about-your-postman-local-vault). ## Access your Postman Vault You can open your Postman Vault from the [Postman desktop app](/docs/getting-started/installation/installation-and-updates/) or the [Postman web app](/docs/getting-started/installation/installation-and-updates/#use-the-postman-web-app). To open your Postman Vault, open a workspace then select

**Vault** from the Postman footer. You can also select **Control+Shift+V** or **Ctrl+Shift+V** to open your Postman Vault. If this is your first time opening your Postman Vault, Postman generates your vault key when you open your Postman Vault. [Save your vault key](/docs/sending-requests/postman-vault/postman-vault-key/) to open your Postman Vault when you sign in to Postman again later. You'll need to enter your vault key each time you sign in to Postman to open your Postman Vault. You can enter your vault key in the following ways, depending on how you saved your vault key: * If you stored your vault key in your system's password manager, Postman will get your vault key and open your Postman Vault. If you're using the Postman web app, make sure you're using the [Postman Desktop Agent](/docs/getting-started/basics/about-postman-agent/#postman-desktop-agent) so Postman can get your vault key. * If you chose not to store your vault key in your system's password manager, open your Postman Vault, manually enter your vault key, and select **Open Vault**. > Postman recommends you [use the latest version](/docs/getting-started/basics/about-postman-agent/#update-the-postman-desktop-agent) of the Postman Desktop Agent to receive recent changes and improvements. ## About vault secrets *Vault secrets* are sensitive data, such as API keys and passwords, that you store in your [local vault](#about-your-postman-local-vault) or [cloud vaults](#about-postman-cloud-vaults) and reuse in Postman. Vault secrets in your local vault are stored in your local instance of Postman, and they aren't synced to the Postman cloud. Vault secrets in your cloud vaults are synced to the Postman cloud, and you can access and reuse them across devices. Your [vault key](/docs/sending-requests/postman-vault/postman-vault-key/) is required to encrypt and decrypt vault secrets in your local vault or cloud vaults. Only you can access and reuse your vault secrets. Postman will never have permission to access and reuse your vaults secrets. Vault secrets in your local vault and cloud vaults are encrypted using Advanced Encryption Standard (AES) with a 256-bit key length. Vault secrets synced to the Postman cloud are end-to-end encrypted. Collaborators can see references to your vault secrets, such as `{{vault:postman-api-key}}`, in shared workspaces, enabling secure collaboration between teammates. API consumers can also see references to your vault secrets in public workspaces, enabling you to show an example of a secret. Collaborators and API consumers can add each vault secret to their Postman Vault with their own value. If you're on an [Enterprise plan with the Advanced Security Administration add-on](https://www.postman.com/pricing/), you can link vault secrets with sensitive data stored in an external vault, such as Azure Key Vault. Learn more about [Postman Vault integrations](/docs/sending-requests/postman-vault/postman-vault-integrations/). > Learn about the [features that require the Postman desktop app](#feature-availability). ## About your Postman Local Vault By default, you have a local vault in your Postman Vault that's only available in your local instance of Postman. Only you can access and reuse values associated with vault secrets in your local vault, and they aren't synced to the Postman cloud. You can't rename, delete, or create a new local vault. Vault secrets stored in your local vault are deleted after signing out of Postman. Vault secrets in your local vault can't be recovered with your vault key. When you sign in to Postman and open your Postman Vault, you can add vault secrets back to your local vault. To preserve your vault secrets after signing out of Postman, store your vault secrets in a [cloud vault](#about-postman-cloud-vaults) that's synced to the Postman cloud. To access your local vault, [open your Postman Vault](#access-your-postman-vault) then select **Local Vault**. ## About Postman Cloud Vaults You can create cloud vaults in your Postman Vault that are synced to the Postman cloud. Vault secrets stored in a cloud vault are preserved when you sign out of Postman. You must enter your vault key to open your Postman Vault and access vault secrets stored in your cloud vaults. If you lose access to your vault key, vault secrets in your cloud vaults can't be restored. Note that each user in your team can only create one cloud vault. To create a cloud vault, do the following: 1. [Open your Postman Vault](#access-your-postman-vault). 1. Select

**Create new Cloud Vault**. The cloud vault will then sync to the Postman cloud. 1. Enter a name for the cloud vault. Cloud vault names must start with an alphabetical letter, and contain only dashes, underscores, and can't contain spaces. Once you create a cloud vault, you can select it from your Postman Vault to view its vault secrets. To delete a cloud vault, select

**View more actions > Delete**. ## Add vault secrets Add sensitive data, such as API keys and passwords, to your local vault or a cloud vault and [reuse vault secrets](#use-vault-secrets) in your Postman team. > You can also [use Guided Auth to add vault secrets](#add-authorization-as-vault-secrets-using-guided-auth) that have authentication credentials for public APIs, and reference them in your requests. To add secrets to your Postman Vault, do the following: 1. [Open your Postman Vault](#access-your-postman-vault). 1. Select your local vault or a cloud vault you'd like to add the vault secret to. 1. Enter the following values in an empty row: * **Key** - The name of the vault secret. You'll use the name to [reference the secret](#use-vault-secrets). * **Value** - The value used when sending requests in your Postman team. It's never synced to your account or shared with your team. > To show or hide a vault secret's value, hover over the secret and select

**View** or

**Hide**. * **Allowed domains** - The comma-separated list of domains and subdomains you're allowed to send requests to with the vault secret. This enables you to prevent unintentional disclosure of sensitive data in your vault secret. By default, you can include vault secrets in requests to any domain and subdomain. Select the empty cell then enter your allowed domains. > If you specify allowed domains or subdomains for a vault secret, you can only reference the vault secret in requests that match the allowed domain. > To allow sending requests to any subdomain of an allowed domain, use `*` to represent any subdomain. For example, add `*.example.com` to allow sending requests to any subdomain of `example.com`. ![Add secrets to Postman Vault](https://assets.postman.com/postman-docs/v11/add-postman-vault-secrets-cloud-v11-27-b.jpg) > Changes are automatically saved to your Postman Vault. You can also take the following actions to add vault secrets to your local vault or a cloud vault: * [Set existing data](#set-data-as-a-vault-secret) as a vault secret. * [Try out a vault secret](#try-vault-secrets-in-a-request) locally in a request. * [Add a value to a vault secret reference](#add-a-vault-secret-reference-to-your-postman-vault). * [Add authentication credentials for public APIs](#add-authorization-as-vault-secrets-using-guided-auth) as a vault secret. * [Set vault secrets in scripts](#use-vault-secrets-in-scripts). Make sure you enable scripts to access your vault secrets. Otherwise, you'll receive an error in the Postman Console. * [Create an integration](/docs/sending-requests/postman-vault/postman-vault-integrations/) ([Enterprise teams only](https://www.postman.com/pricing/)) that connects your Postman Vault with external vaults, such as Azure Key Vault. This enables you to link vault secrets with sensitive data stored in external vaults, and reuse it in your Postman team. ### Set data as a vault secret To set existing data as a vault secret from the request builder, do the following: 1. [Open your Postman Vault](/docs/sending-requests/postman-vault/postman-vault-secrets/#access-your-postman-vault). 1. Select the data you need. You can select data from the **URL builder**, the **Params** tab, the **Authorization** tab, and the **Headers** tab. 1. Right-click the selected data and select **Set as variable**. 1. Select

**Set as new variable**.

1. Set the data as a vault secret in your local vault or a cloud vault: * To set the data in your local vault, enter the name of the vault secret. * To set the data in a cloud vault, enter the name of a new or existing cloud vault followed by the name of the vault secret, using the `cloud-vault-name/secret-name` syntax. If you enter a cloud vault name that doesn't exist in your Postman Vault, a new cloud vault will be created with that name. 1. Confirm that the value is correct, and select **Vault** as the scope. 1. Select **Set Variable**. ![Set as new vault secret](https://assets.postman.com/postman-docs/v11/set-data-as-vault-secret-v11-14.jpg) ### Try vault secrets in a request You can try out values in your HTTP requests before adding them to your local vault or a cloud vault. If the value works as expected, you can [add the vault secret to your local vault or a cloud vault](#add-a-vault-secret-reference-to-your-postman-vault). You can also create placeholder vault secrets to share with your API consumers. Your consumers can use the placeholder vault secret to add their own sensitive data to their own cloud vault. Create a vault secret reference in an HTTP request without adding the vault secret to your Postman Vault. The value you enter for this vault secret is stored locally and is only available in the request it's set in. In the [variables pane](/docs/getting-started/basics/navigating-postman/#environment-selector-and-variables-pane) under **Variables in request**, the vault secret isn't associated with your Postman Vault. Enter a vault secret reference in the **URL builder**, the **Params** tab, the **Authorization** tab, and the **Headers** tab. [Open your Postman Vault](#access-your-postman-vault), and enter one of the following: * A vault secret name that doesn't exist in your local vault using the `{{vault:secret-name}}` syntax. * A new or existing cloud vault name, and a vault secret name that doesn't exist in the cloud vault using the `{{vault:cloud-vault-name/secret-name}}` syntax. ![Set as new vault secret](https://assets.postman.com/postman-docs/v11/reference-and-create-new-vault-secret-v11-18.jpg) To set a value for a vault secret you're trying out, hover over it, select **Enter value**, then enter a value. You can also select

**Variables** to open the variables pane, select **Enter value** next to a vault secret, then enter a value under **Variables in request**. Values for vault secrets you're trying out are stored locally in a request until you close its tab or sign out of Postman. When you open the request again, the vault secret's value will be empty. Optionally, you can [add the vault secret and its value to your local vault or a cloud vault](#add-a-vault-secret-reference-to-your-postman-vault). ### Add a vault secret reference to your Postman Vault From a Postman element, such as a request or collection, you can create a vault secret and add it to your local vault or a cloud vault. This also enables you to define a default value for a [vault secret you tried out in a request](#try-vault-secrets-in-a-request). [Open your Postman Vault](#access-your-postman-vault), and enter one of the following: * A vault secret name that doesn't exist in your local vault using the `{{vault:secret-name}}` syntax. * A new or existing cloud vault name, and a vault secret name that doesn't exist in the cloud vault using the `{{vault:cloud-vault-name/secret-name}}` syntax. If you enter a cloud vault name that doesn't exist in your Postman Vault, a new cloud vault will be created with that name. Hover over the reference to the vault secret, select **Enter value**, enter the value, then select

**Add to Vault**. ![Add secret to Postman Vault](https://assets.postman.com/postman-docs/v11/add-vault-secret-to-postman-vault-v11-18.jpg) You can also select

**Variables** in the [workbench](/docs/getting-started/basics/navigating-postman/#environment-selector-and-variables-pane) to open the variables pane and view the vault secrets used in your request. Select **Enter value** next to the vault secret, enter a value, then select

**Add to Vault**. > To store the value as a variable, remove the `vault:` prefix, then follow the instructions to [add the variable to a scope](/docs/sending-requests/variables/variables/#adding-variables-to-a-scope). ### Add authorization as vault secrets using Guided Auth Guided Auth enables you to set up authentication credentials for public APIs by following steps set up by API publishers. Once you set up your authentication credentials using Guided Auth, you can store them in your Postman Vault and reuse them throughout your workspaces. Learn how to [explore public APIs](/docs/postman-api-network/explore/) on the Postman API Network. If you're an API publisher, learn how to [set up Guided Auth for your public APIs in Postman](/docs/publishing-your-api/setting-up-authentication-for-public-apis/). Guided Auth supports public APIs that require bearer, basic, API key, or OAuth 2.0 authentication credentials. If an API supports token refresh, Postman automatically refreshes OAuth 2.0 tokens that were stored in your Postman Vault using Guided Auth. To add authentication credentials as vault secrets using Guided Auth, do the following: 1. Open an HTTP request, and enter the URL for a public API that has Guided Auth set up, such as `https://api.getpostman.com/`. 1. Select the **Authorization** tab, select the **Auth Type** dropdown list, then select the authentication option you'd like to use under **Recommended setup**. > If the public API has only one API authentication configured, you can select **Set up new authorization** when you enter the URL. This takes you directly to the instructions for getting your credentials. > > ![Set up new auth using Guided Auth](https://assets.postman.com/postman-docs/v11/set-up-new-auth-v11-16.jpg) Add credentials using Guided Auth

1. Generate and enter your authentication credentials: * For APIs that require authentication credentials like tokens or API keys, follow the instructions to get your credentials. Then enter them in the field under **Auth credentials**. * For APIs that support OAuth 2.0, select **Authorize** to get your credentials and automatically enter the access token in the field under **Auth credentials**. 1. Select the **Vault** dropdown menu and choose the vault where you'd like to store your credentials: * (Default) Select **Local Vault** to add the vault secret to your local vault. * Select one of your cloud vaults to add the vault secret to a cloud vault. 1. Select **Store Auth in Vault**. ![Store auth in Postman Vault](https://assets.postman.com/postman-docs/v11/store-auth-in-postman-vault-v11-27.jpg) If you haven't entered your vault key since signing in to Postman, you'll be asked to enter it. 1. Enter the **Auth method name** for the authentication credentials. By default, the auth method name is the public API's name, such as "Postman API", but you can use a different name if you'd like. The auth method name is used to categorize the associated vault secret in your Postman Vault. The auth method name is also used to generate the vault secret's key. For example, if you enter *Postman API Key* as the auth method name for an API key, the vault secret's key will be `postman-api-key:value`. > If you use an auth method name that already exists in your Postman Vault, the existing auth method will be overwritten. 1. Select **Store**. In the **Auth Type** dropdown list of the request, the auth method name will be selected under **Stored in vault**. Stored credentials in Auth Type list

To view your authentication credentials in your local vault or a cloud vault, select the created auth method name as the auth type, then select **View in vault**. You can also select

**Vault** from the Postman footer. Learn more about [opening your Postman Vault](#access-your-postman-vault). In your Postman Vault, vault secrets added using Guided Auth are stored under **Created with guided auth**, and they're categorized by the auth method name. Each vault secret's key name is automatically appended with a suffix, which you shouldn't edit: * For APIs that require authentication credentials like tokens or API keys, the suffix represents the authentication type, such as `:token`. * For APIs that support OAuth 2.0, multiple vault secrets are added to your Postman Vault, including the access token and additional properties returned by the public API (like the token type). Each vault secret has a suffix that represents the value, such as `:accessToken` and `:tokenType`. ![Vault secret created with Guided Auth](https://assets.postman.com/postman-docs/v11/postman-vault-guided-auth-v11-27.jpg) The allowed domains for the vault secret are autofilled with the domains and subdomains for the public API. This is a comma-separated list of domains and subdomains you're allowed to send requests to with the vault secret. This enables you to prevent unintentional disclosure of sensitive data in your vault secret. Postman uses this information to suggest using saved authorization in future HTTP requests to the domain or subdomain. > If you specify allowed domains or subdomains for a vault secret, you can only reference the vault secret in requests that match the allowed domain. ## Use vault secrets You can reference vault secrets stored in your local vault or a cloud vault in your HTTP collections and requests from the **URL builder**, the **Params** tab, the **Authorization** tab, the **Headers** tab, and the **Body** tab. You can use the Collection Runner to [manually run collections](/docs/collections/running-collections/intro-to-collection-runs/) that reference vault secrets. Scheduled collection runs, monitors, the Postman CLI, and Newman don't support vault secrets. You can [access vault secrets in scripts](#use-vault-secrets-in-scripts). Make sure you enable scripts to access your vault secrets. Otherwise, you'll receive an error in the Postman Console. > If you're using the Postman web app to send requests with references to vault secrets, use the latest version of the [Postman Desktop Agent](/docs/getting-started/basics/about-postman-agent/#postman-desktop-agent). You can also use the [Postman Browser Agent](/docs/getting-started/basics/about-postman-agent/#postman-browser-agent), but you may experience the CORS limitations of browsers. > > If you're referencing vault secrets linked from an external vault, you must use the Postman desktop app. Learn about [external vault integrations](/docs/sending-requests/postman-vault/postman-vault-integrations/). To reference a vault secret in your local vault, put the vault secret inside double curly braces (`{{ }}`) and append the prefix `vault:` to the vault secret's name. For example, to reference a vault secret named "postman-api-key", use the following syntax: ```txt {{vault:postman-api-key}} ``` To reference a vault in a cloud vault, put the vault secret inside double curly braces (`{{ }}`) and append the prefix `vault:` to the cloud vault and vault secret's name. For example, to reference a vault secret named "postman-api-key" in a cloud vault named "postman_engineering", use the following syntax: ```txt {{vault:postman_engineering/postman-api-key}} ``` ![Reference vault secrets in Postman](https://assets.postman.com/postman-docs/v11/use-postman-vault-secrets-v11-12.jpg) > To learn how to troubleshoot empty or unresolved vault secrets, see [Troubleshoot vault secrets](#troubleshoot-vault-secrets). Vault secrets stored in your Postman Vault are masked by default when they're logged to the [Postman Console](/docs/sending-requests/response-data/troubleshooting-api-requests/). To edit whether vault secrets are masked in the Postman Console, select

**Vault Settings**, then turn the toggle on or off next to **Mask vault secrets** from the **Settings** tab. If you reference a vault secret as the initial value of a variable, such as an environment variable, the reference to the secret (for example `{{vault:secret-name}}`) is synced using Postman's cloud servers, and shared with anyone who has access to the workspace. The vault secret's value stored in your Postman Vault isn't synced or shared. Learn more about [initial and current values](/docs/sending-requests/variables/variables/#initial-and-current-values). ### Use vault secrets in scripts You can use the `pm.vault` methods in your scripts in your HTTP collections and requests to access or manipulate vault secrets in your local vault or cloud vaults. Make sure you enable scripts to access your vault secrets. To keep vault secrets in your Postman Vault secure, make sure to only run scripts you trust. The `pm.vault` methods run asynchronously in your scripts. Each method also returns a Promise object that represents the completion or failure of the method. Add the `await` operator before each `pm.vault` method to wait for the Promise and its resulting value. Note that a method without the `await` operator may run in your script, but it may not behave as expected. For example: ```js console.log(await pm.vault.get("secretKey")); await pm.vault.set("secretKey", "newValue"); await pm.vault.unset("secretKey"); ``` To access and manipulate vault secrets in your local vault, enter the name of an existing vault secret, such as `await pm.vault.get("secretKey")`. To access and manipulate vault secrets in a cloud vault, enter the name of an existing cloud vault and vault secret, such as `await pm.vault.get("cloudVault/secretKey")`. Learn more about [using vault secrets in scripts](/docs/tests-and-scripts/write-scripts/postman-sandbox-api-reference/#use-vault-secrets-in-scripts). ## Edit vault secrets You can edit vault secrets stored in your local vault or a cloud vault by updating them and their allowed domains, changing a vault secret's name, making vault secrets unavailable, or deleting vault secrets. You can also edit the value of vault secrets directly from requests that references it or can access it. To edit vault secrets stored in your local vault or a cloud vault, [open your Postman Vault](#access-your-postman-vault). You can take the following actions: * To filter the list of vault secrets by name, enter text in the **Filter secrets** box. * To sort the list of vault secrets, select a column header. You can toggle between ascending and descending order. * To add a new vault secret, select **Add new secret** in the bottom row of the table. * To update the key or value for the vault secret, select the relevant cell. * To delete a vault secret, hover over a secret, then select

**View more actions > Delete**. * To update the list of allowed domains, select the empty cell or list of domains. * To make a vault secret unavailable without deleting it, clear the checkbox next to the secret. Any references to the secret will be unresolved. To make the secret available again, select the checkbox. * (*Cloud vaults only*) To edit a cloud vault's name, select

**View more actions > Rename**. Make sure to update existing references to a vault secret with the new cloud vault name. * (*Vault secrets added using Guided Auth only*) To edit an auth method name, hover over an auth method name, and select

**Edit**. * To [link a different secret from an external vault](/docs/sending-requests/postman-vault/manage-postman-vault-integrations/#link-a-different-secret-from-an-external-vault), select

**Configure vault** next to the vault secret you want to update, then select

**Edit**. ![Edit vault secrets](https://assets.postman.com/postman-docs/v11/edit-postman-vault-secrets-v11-27.jpg) > Changes are automatically saved to your Postman Vault. ## Postman Vault integrations > **[Postman Vault integrations are available with Postman Enterprise plans with the Advanced Security Administration add-on.](https://www.postman.com/pricing/)** [Postman Vault integrations](/docs/sending-requests/postman-vault/postman-vault-integrations/) enable you to link vault secrets with secrets that are stored in an external vault. You can then reference vault secrets in your Postman team, and retrieve the value of external vault secrets using end-to-end encryption when you send HTTP requests. You can [manage and update](/docs/sending-requests/postman-vault/manage-postman-vault-integrations/) your Postman Vault integrations. Postman supports the following Postman Vault integrations: * [1Password](/docs/sending-requests/postman-vault/1password/) * [AWS Secrets Manager](/docs/sending-requests/postman-vault/aws-secrets-manager/) * [Azure Key Vault](/docs/sending-requests/postman-vault/azure-key-vault/) * [HashiCorp Vault](/docs/sending-requests/postman-vault/hashicorp-vault/) > You can create Postman Vault integrations from the [Postman desktop app](/docs/getting-started/installation/installation-and-updates/). ## Feature availability The following features require the Postman desktop app: * **Open Postman Vault from public workspaces** - You must use the Postman desktop app to open your Postman Vault from a [public workspace](/docs/collaborating-in-postman/using-workspaces/public-workspaces/), and reference vault secrets in a public workspace. If you're using the Postman web app, you must add new vault secrets to your Postman Vault if you're opening it from a public workspace. * **Create and manage Postman Vault integrations** ([Enterprise teams only](https://www.postman.com/pricing/)) - You must use the Postman desktop app to [create and manage Postman Vault integrations](/docs/sending-requests/postman-vault/postman-vault-integrations/). If you're using the Postman web app, Postman Vault integrations won't be available. ## Troubleshoot vault secrets Vault secrets can be empty or unresolved in your HTTP requests. An *empty vault* secret is a vault secret that doesn't have a value but is referenced in your request. An empty vault secret may or may not exist in your Postman Vault. An *unresolved vault secret* is a vault secret that exists in your Postman Vault but the value can't be accessed from your request. A vault secret in a cloud vault may be empty if the cloud vault's name was updated, but references to the vault secret use the previous cloud vault name. To fix this, update references to the vault secret with the correct cloud vault name. To learn more about troubleshooting empty and unresolved vault secrets, see [Troubleshoot vault secrets](/docs/sending-requests/postman-vault/troubleshoot-vault-secrets/).

Postman Flows snapshots and modules