Integrate Postman Shared Vault with external vaults

This feature is available on Postman Enterprise plans with the Advanced Security Administration add-on. For more information, see the pricing page.

You can connect Postman Shared Vault to an external vault your team already runs, such as Azure Key Vault or HashiCorp Vault. Instead of storing a secret’s value in Postman, you store a reference to it. Postman resolves the reference and fetches the value when you send a request or run a monitor.

Postman never stores the value of a secret retrieved from an external vault. It stores only the reference you provide, such as the Azure secret identifier or the HashiCorp secret location (the secrets engine mount, KV version, secret path, and optional field and version).

About Shared Vault integrations

A Shared Vault integration connects your team to an external vault. An Admin, Super Admin, or Security Manager creates a connection in your team settings, and members then link keys in a workspace’s shared vault to secrets in that external vault. Who can use a linked key depends on its access scope, as with any shared vault secret. Because linked keys can resolve in the Postman Cloud, monitors and other unattended runs can use them too.

This differs from a Local Vault integration, which each team member creates from their own Postman Local Vault. Those links are visible only to the member who created them, and they’re supported in the Postman desktop app only.

An integration has two parts:

A connection identifies which external vault to read from and belongs to your whole team. For Azure Key Vault, it’s the Microsoft Entra directory (tenant) that owns your key vaults. For HashiCorp Vault, it’s the server URL and namespace.
An authentication method determines how Postman identifies itself when it reads a secret. A connection can have more than one authentication method, and you choose which ones your team needs.

One connection can serve linked keys in many workspaces, because each workspace has its own shared vault.

Every supported external vault offers two kinds of authentication method:

	Per-user	Machine
Identity used	The team member’s own identity in the external vault	An application identity stored on the connection
Where the secret resolves	On the member’s device, in the Postman desktop app	In the Postman Cloud
Use it for	Sending requests from the Postman desktop app	Monitors and other unattended runs
Azure Key Vault method	Microsoft Entra user (sign in on this device)	Service principal (client secret)
HashiCorp Vault method	OIDC (per-user SSO)	AppRole (machine)

An unattended run can use a machine authentication method only. A connection with a per-user method only can’t resolve secrets in monitors, scheduled runs, the Postman CLI, or deployed flows. To use external vault secrets in those, configure a machine method on the connection.

Only users with the Admin, Super Admin, or Security Manager role can create and configure connections. Every team member can view connections in team settings, and Workspace Editors can link keys in their workspaces.

Supported integrations

Postman Shared Vault supports integrations with the following external vaults:

Manage integrations

After you create a connection, you can manage your Shared Vault integrations. Check a connection’s reachability, sign in on your device, update or remove authentication methods, change linked keys, and delete connections.

Troubleshoot vault secrets

To learn how to troubleshoot vault secrets, see Troubleshoot vault secrets.