Skip to navigation
Use PostmanPostman VaultShared Vault integrations

Manage Shared Vault integrations

View as Markdown

This feature is available on Postman Enterprise plans with the Advanced Security Administration add-on. For more information, see the pricing page.

Once your team has a Postman Shared Vault integration, you can check that Postman can reach your external vault. You can also sign in and out on your own device, and update or remove the connection’s authentication methods.

The tasks on this page work the same way for every supported external vault. For the steps to set up a new integration, see Azure Key Vault or HashiCorp Vault.

Check a connection’s reachability

As a Postman Admin, Super Admin, or Security Manager, you can check whether Postman can reach a connection’s external vault.

  1. Click Settings in the Postman header, then select Team settings.
  2. Under Security & Governance, click Shared vault, then select the External vault integrations tab.
  3. Click Check reachability on a connection.

The connection’s status reads either Reachable or Unreachable.

Reachability tells you only that something answered. For Azure Key Vault, it confirms the directory exists. For HashiCorp Vault, it confirms a server answered at the URL, which might not be a working HashiCorp Vault server. It doesn’t use the credentials you configured, and it doesn’t confirm that an authentication method can read a particular secret. The result is informational, so you can still link keys to a connection that reports Unreachable.

To confirm that a secret resolves, send a request that references it, or run a monitor and check the run’s Console Log.

Sign in and out on your device

A per-user authentication method resolves secrets with your own identity in the external vault, so you sign in yourself before you can use a linked key. Each connection requires its own sign-in, on each device you use. Per-user methods are supported in the Postman desktop app only.

To sign in to a connection, do the following:

  1. Open a workspace in the Postman desktop app.
  2. Click Vault in the footer, and select Shared Vault.
  3. On the External vaults tab, click Sign in on this device next to the connection.
  4. Sign in with an account from the connection’s Microsoft Entra directory, or with your identity provider account for HashiCorp Vault, and grant consent if you’re prompted.

The connection’s status changes to Signed in. To end the session, click Sign out next to the connection. After you sign out, linked keys on that connection stop resolving until you sign in again.

You can also sign in from the request you’re working on. Postman flags a variable that needs a sign-in. Hover over the reference to display Sign in to resolve this secret, with options to sign in on your device or open the shared vault.

You can update a linked key without recreating it. In your workspace’s shared vault, hover over the key’s row on the External vaults tab, then click Edit icon Edit.

You can change the key’s name, its Allowed domains, and the secret’s location in your external vault. For Azure Key Vault, that’s the Secret identifier. For HashiCorp Vault, you can change the secrets engine mount, KV engine version, secret path, field selector, and secret version. Click Update link to save your changes.

You can’t change which connection a key uses. To read a key from a different connection, unlink the key and link it again.

To unlink a key, click Delete icon Delete on its row. Postman removes the reference from your shared vault and leaves the secret in your external vault untouched.

Edit an authentication method

As a Postman Admin, Super Admin, or Security Manager, you can change how a connection authenticates without recreating it. In team settings, open the External vault integrations tab, then click Edit next to an authentication method.

You can update a method’s configuration in place, such as an Azure service principal’s Application (client) ID or a HashiCorp method’s Vault auth mount path.

For a machine method, the Credentials options control whether Postman keeps or replaces the stored credentials:

  • Keep current credentials — Saves your configuration changes and leaves the stored credentials as they are.
  • Replace credentials — Prompts you for the credential values again. Postman stores credentials write-only and can’t display them, so replacing them is the only way to change them.

Use Replace credentials to rotate a credential that has expired, such as an Azure client secret or a HashiCorp secret ID.

If you change an Azure service principal’s Application (client) ID, also choose Replace credentials and enter the new app’s client secret, because the stored secret belongs to the previous app.

Members who are already signed in keep using the previous settings, and can keep resolving linked keys, until they reload the window or restart Postman. Because team settings opens in your web browser, a change you make there doesn’t appear in an open desktop app until members select Help > Clear Cache and Reload or restart Postman.

Remove an authentication method

As a Postman Admin, Super Admin, or Security Manager, click Remove next to an authentication method to delete it and its stored credentials.

Removing a method changes what the connection can do. Without a machine method, secrets can’t resolve in monitors or other unattended runs. Without a per-user method, members can’t resolve secrets for requests they send themselves. Members who are already signed in to a per-user method can keep resolving linked keys until they reload the window or restart Postman.

A connection with no authentication methods configured can’t resolve secrets, and it isn’t available to select when you link a new shared vault key.

Delete a connection

As a Postman Admin, Super Admin, or Security Manager, click Delete next to a connection to remove it, along with its authentication methods and stored credentials. Deleting a connection can’t be undone.

You can’t delete a connection while shared vault keys still reference it. Postman shows you how many keys would stop working, lists the affected keys, and asks you to unlink or remove them first.

To stop a connection’s keys from resolving without deleting the connection, remove its authentication methods instead. This leaves the keys and the connection in place, so you can restore resolution by configuring a method again.

You’ll also delete and recreate a connection to change where it points. A connection’s provider details can’t be edited after you create it. That includes an Azure Key Vault connection’s Directory (tenant) ID and a HashiCorp Vault connection’s Server URL.

Next steps