> This page is for Postman Docs, version Latest (v12) (default).
> For other versions, use one of these documentation indexes:
> - Latest (v12) (default): https://learning.postman.com/latest-v-12/llms.txt
> - v11: https://learning.postman.com/v11/llms.txt

> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://learning.postman.com/llms.txt.

# Integrate Postman Shared Vault with external vaults

> **Info**
>
> This feature is available on Postman Enterprise plans with the Advanced Security Administration add-on. For more information, see the [pricing page](https://www.postman.com/pricing/).

You can connect [Postman Shared Vault](/docs/use/postman-vault/postman-vault-secrets/) to an external vault your team already runs, such as Azure Key Vault or HashiCorp Vault. Instead of storing a secret's value in Postman, you store a reference to it. Postman resolves the reference and fetches the value when you send a request or run a monitor.

Postman never stores the value of a secret retrieved from an external vault. It stores only the reference you provide, such as the Azure secret identifier or the HashiCorp secret location (the secrets engine mount, KV version, secret path, and optional field and version).

## About Shared Vault integrations

A Shared Vault integration connects your team to an external vault. An Admin, Super Admin, or Security Manager creates a connection in your team settings, and members then link keys in a workspace's shared vault to secrets in that external vault. Who can use a linked key depends on its access scope, as with any shared vault secret. Because linked keys can resolve in the Postman Cloud, monitors and other unattended runs can use them too.

This differs from a [Local Vault integration](/docs/use/postman-vault/postman-vault-integrations/), which each team member creates from their own [Postman Local Vault](/docs/use/postman-vault/postman-vault-key/#postman-local-vault). Those links are visible only to the member who created them, and they're supported in the [Postman desktop app](/docs/getting-started/installation/install-app/) only.

An integration has two parts:

* A **connection** identifies which external vault to read from and belongs to your whole team. For Azure Key Vault, it's the Microsoft Entra directory (tenant) that owns your key vaults. For HashiCorp Vault, it's the server URL and namespace.
* An **authentication method** determines how Postman identifies itself when it reads a secret. A connection can have more than one authentication method, and you choose which ones your team needs.

One connection can serve linked keys in many workspaces, because [each workspace has its own shared vault](/docs/use/postman-vault/postman-vault-key/#postman-shared-vault).

Every supported external vault offers two kinds of authentication method:

|                               | Per-user                                             | Machine                                          |
| :---------------------------- | :--------------------------------------------------- | :----------------------------------------------- |
| **Identity used**             | The team member's own identity in the external vault | An application identity stored on the connection |
| **Where the secret resolves** | On the member's device, in the Postman desktop app   | In the Postman Cloud                             |
| **Use it for**                | Sending requests from the Postman desktop app        | Monitors and other unattended runs               |
| **Azure Key Vault method**    | Microsoft Entra user (sign in on this device)        | Service principal (client secret)                |
| **HashiCorp Vault method**    | OIDC (per-user SSO)                                  | AppRole (machine)                                |

> **Info**
>
> An unattended run can use a machine authentication method only. A connection with a per-user method only can't resolve secrets in monitors, scheduled runs, the Postman CLI, or deployed flows. To use external vault secrets in those, configure a machine method on the connection.

Only users with the [Admin, Super Admin, or Security Manager](/docs/administration/roles-and-permissions#team-roles) role can create and configure connections. Every team member can view connections in team settings, and Workspace Editors can link keys in their workspaces.

## Supported integrations

Postman Shared Vault supports integrations with the following external vaults:

* [Azure Key Vault](/docs/use/postman-vault/shared-vault-azure-key-vault/)
* [HashiCorp Vault](/docs/use/postman-vault/shared-vault-hashicorp-vault/)

## Manage integrations

After you create a connection, you can [manage your Shared Vault integrations](/docs/use/postman-vault/shared-vault-manage-integrations/). Check a connection's reachability, sign in on your device, update or remove authentication methods, change linked keys, and delete connections.

## Troubleshoot vault secrets

To learn how to troubleshoot vault secrets, see [Troubleshoot vault secrets](/docs/use/postman-vault/troubleshoot-vault-secrets/).