> This page is for Postman Docs, version Latest (v12) (default). > For other versions, use one of these documentation indexes: > - Latest (v12) (default): https://learning.postman.com/latest-v-12/llms.txt > - v11: https://learning.postman.com/v11/llms.txt > For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://learning.postman.com/llms.txt. # Manage Shared Vault integrations > **Info** > > This feature is available on Postman Enterprise plans with the Advanced Security Administration add-on. For more information, see the [pricing page](https://www.postman.com/pricing/). Once your team has a [Postman Shared Vault integration](/docs/use/postman-vault/shared-vault-integrations/), you can check that Postman can reach your external vault. You can also sign in and out on your own device, and update or remove the connection's authentication methods. The tasks on this page work the same way for every supported external vault. For the steps to set up a new integration, see [Azure Key Vault](/docs/use/postman-vault/shared-vault-azure-key-vault/) or [HashiCorp Vault](/docs/use/postman-vault/shared-vault-hashicorp-vault/). ## Check a connection's reachability As a Postman [Admin, Super Admin, or Security Manager](/docs/administration/roles-and-permissions#team-roles), you can check whether Postman can reach a connection's external vault. 1. Click **Settings** in the Postman header, then select **Team settings**. 2. Under **Security & Governance**, click **Shared vault**, then select the **External vault integrations** tab. 3. Click **Check reachability** on a connection. The connection's status reads either **Reachable** or **Unreachable**. > **Info** > > Reachability tells you only that something answered. For Azure Key Vault, it confirms the directory exists. For HashiCorp Vault, it confirms a server answered at the URL, which might not be a working HashiCorp Vault server. It doesn't use the credentials you configured, and it doesn't confirm that an authentication method can read a particular secret. The result is informational, so you can still link keys to a connection that reports **Unreachable**. To confirm that a secret resolves, send a request that references it, or run a monitor and check the run's **Console Log**. ## Sign in and out on your device A per-user authentication method resolves secrets with your own identity in the external vault, so you sign in yourself before you can use a linked key. Each connection requires its own sign-in, on each device you use. Per-user methods are supported in the [Postman desktop app](/docs/getting-started/installation/install-app/) only. To sign in to a connection, do the following: 1. Open a workspace in the Postman desktop app. 2. Click **Vault** in the footer, and select **Shared Vault**. 3. On the **External vaults** tab, click **Sign in on this device** next to the connection. 4. Sign in with an account from the connection's Microsoft Entra directory, or with your identity provider account for HashiCorp Vault, and grant consent if you're prompted. The connection's status changes to **Signed in**. To end the session, click **Sign out** next to the connection. After you sign out, linked keys on that connection stop resolving until you sign in again. You can also sign in from the request you're working on. Postman flags a variable that needs a sign-in. Hover over the reference to display **Sign in to resolve this secret**, with options to sign in on your device or open the shared vault. ## Change or unlink a key You can update a linked key without recreating it. In your workspace's shared vault, hover over the key's row on the **External vaults** tab, then click ![Edit icon](https://assets.postman.com/postman-docs/aether-icons/v12/icon-action-edit-stroke.svg#icon) **Edit**. You can change the key's name, its **Allowed domains**, and the secret's location in your external vault. For Azure Key Vault, that's the **Secret identifier**. For HashiCorp Vault, you can change the secrets engine mount, KV engine version, secret path, field selector, and secret version. Click **Update link** to save your changes. > **Info** > > You can't change which connection a key uses. To read a key from a different connection, unlink the key and link it again. To unlink a key, click ![Delete icon](https://assets.postman.com/postman-docs/aether-icons/v12/icon-action-delete-stroke.svg#icon) **Delete** on its row. Postman removes the reference from your shared vault and leaves the secret in your external vault untouched. ## Edit an authentication method As a Postman Admin, Super Admin, or Security Manager, you can change how a connection authenticates without recreating it. In [team settings](#check-a-connections-reachability), open the **External vault integrations** tab, then click **Edit** next to an authentication method. You can update a method's configuration in place, such as an Azure service principal's **Application (client) ID** or a HashiCorp method's **Vault auth mount path**. For a machine method, the **Credentials** options control whether Postman keeps or replaces the stored credentials: * **Keep current credentials** — Saves your configuration changes and leaves the stored credentials as they are. * **Replace credentials** — Prompts you for the credential values again. Postman stores credentials write-only and can't display them, so replacing them is the only way to change them. Use **Replace credentials** to rotate a credential that has expired, such as an Azure client secret or a HashiCorp secret ID. If you change an Azure service principal's **Application (client) ID**, also choose **Replace credentials** and enter the new app's client secret, because the stored secret belongs to the previous app. > **Info** > > Members who are already signed in keep using the previous settings, and can keep resolving linked keys, until they reload the window or restart Postman. Because team settings opens in your web browser, a change you make there doesn't appear in an open desktop app until members select **Help > Clear Cache and Reload** or restart Postman. ## Remove an authentication method As a Postman Admin, Super Admin, or Security Manager, click **Remove** next to an authentication method to delete it and its stored credentials. Removing a method changes what the connection can do. Without a machine method, secrets can't resolve in monitors or other unattended runs. Without a per-user method, members can't resolve secrets for requests they send themselves. Members who are already signed in to a per-user method can keep resolving linked keys until they reload the window or restart Postman. > **Info** > > A connection with no authentication methods configured can't resolve secrets, and it isn't available to select when you link a new shared vault key. ## Delete a connection As a Postman Admin, Super Admin, or Security Manager, click **Delete** next to a connection to remove it, along with its authentication methods and stored credentials. Deleting a connection can't be undone. You can't delete a connection while shared vault keys still reference it. Postman shows you how many keys would stop working, lists the affected keys, and asks you to unlink or remove them first. > **Info** > > To stop a connection's keys from resolving without deleting the connection, [remove its authentication methods](#remove-an-authentication-method) instead. This leaves the keys and the connection in place, so you can restore resolution by configuring a method again. You'll also delete and recreate a connection to change where it points. A connection's provider details can't be edited after you create it. That includes an Azure Key Vault connection's **Directory (tenant) ID** and a HashiCorp Vault connection's **Server URL**. ## Next steps * To learn how connections and authentication methods work, see [Integrate Postman Shared Vault with external vaults](/docs/use/postman-vault/shared-vault-integrations/). * To learn how to reference vault secrets, see [Use vault secrets](/docs/use/postman-vault/use-vault-secrets/). * To learn how to troubleshoot vault secrets, see [Troubleshoot vault secrets](/docs/use/postman-vault/troubleshoot-vault-secrets/).