> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# HashiCorp Vault connection

> Learn how to configure a HashiCorp Vault Connection for Infisical.

> [!NOTE]
>
> Infisical is compatible with Vault Self-hosted, HCP Vault Dedicated, and HCP Vault Enterprise deployments. Please note that HCP Generic Secrets are currently not supported.

Infisical supports two methods for connecting to HashiCorp Vault.

> [tab] App Role (Recommended)
>
> **1. Navigate to Vault Access**
>
> ![Vault Access](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-access.png)
>
> **2. Enable New Method**
>
> In the **Authentication Methods** tab, select **Enable new method**.
>
> ![Vault Enable Method](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-authentication-methods.png)
>
> **3. Select AppRole**
>
> ![Vault AppRole](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-approle.png)
>
> **4. Enable Method**
>
> You may change the name of the method, but we suggest keeping it as `approle`.
>
> ![Vault Enable Method](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-enable-method.png)
>
> **5. Navigate to Vault Policies**
>
> From the home page, navigate to **Policies**.
>
> ![Vault Policies Navigate](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-policies-navigate.png)
>
> **6. Create ACL Policy**
>
> ![Vault Policies Page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-policies-page.png)
>
> **7. Create Policy**
>
> You may name your policy whatever you want, but remember the name as it will be used in future steps.
>
> Depending on your use case, you may have different policy configurations:
>
> > [tab] Secret Sync
> >
> > ```hcl theme={"dark"}
> > path "demo_mount/data/*" {
> >   capabilities = [ "create", "read", "update", "delete" ]
> > }
> >
> > path "sys/mounts" {
> >   capabilities = ["read"]
> > }
> > ```
> >
> > * **demo\_mount**: The name of the target secrets engine (e.g., 'secret', 'kv').
> >
> > * **data/\***: The path within the secrets engine used for storing secrets. The wildcard (\*) grants access to all secrets within this mount point.
> >
> > > [!NOTE]
> > >
> > > Make sure to replace the policy path with the specific path where you intend to sync your secrets. For better security and control, it's recommended to use a more granular path instead of a wildcard (\*). You can also specify a path that doesn’t yet exist—Infisical will automatically create it for you during the sync process.
>
> ![Vault Create Policy](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-create-policy.png)
>
> **8. Run Shell Commands**
>
> **Open Vault Shell**
>
> ![Vault Shell](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-shell.png)
>
> > [!NOTE]
> >
> > If you used custom approle or policy names in previous steps, you'll need to customize the following commands.
>
> **Create Infisical Role**
>
> ```hcl theme={"dark"}
> vault write auth/approle/role/infisical token_policies="infisical-policy" token_ttl=30s token_max_ttl=2m
> ```
>
> **Read RoleID**
>
> ```hcl theme={"dark"}
> vault read auth/approle/role/infisical/role-id
> ```
>
> **Generate New SecretID**
>
> ```hcl theme={"dark"}
> vault write -force auth/approle/role/infisical/secret-id
> ```
>
> Your shell output should look similar to the image below. Save the RoleID and SecretID values for later steps.
>
> ![Vault Shell Output](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-shell-output.png)

> [tab] Access Token
>
> ## Get a HashiCorp Vault access token
>
> Open your profile dropdown and click **Copy token**. This token will be used in later steps.
>
> ![Vault Profile Copy Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-profile-token.png)

## Getting Vault instance URL

> [tab] Self Hosted
>
> For self-hosted instances, locate and copy your vault's base URL (for example: `https://vault.example.com`).
>
> Save the URL for later steps.

> [tab] Hashicorp Cloud Platform
>
> On HCP instances, you may need to navigate to **Cluster Overview** to see your cluster URL. Save this value for later steps.
>
> ![Vault Cluster URLs](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-cluster-urls.png)
>
> > [!NOTE]
> >
> > Cluster Overview is found in the HCP dashboard, not in your cluster's web UI.

## Setup Vault connection in Infisical

> [tab] Infisical UI
>
> **1. Navigate to App Connections**
>
> In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.
>
> ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> **2. Add Connection**
>
> Click the **+ Add Connection** button and select the **HashiCorp Vault Connection** option.
>
> ![Select Vault Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-infisical-connect-page.png)
>
> **3. Configure Connection**
>
> Configure your Vault Connection using the Instance URL and credentials from the steps above. **Depending on if you chose to authenticate with an Access Token or AppRole, you may need to input different information.**
>
> ![Vault Configure Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-infisical-connect-modal.png)
>
> > [tab] App Role
> >
> > * **Name**: The name of the connection being created. Must be slug-friendly.
> > * **Description**: An optional description to provide details about this connection.
> > * **Gateway (optional):** The gateway connected to your private network. All requests made to your Vault instance will be made through the configured gateway.
> > * **Instance URL**: The URL of your HashiCorp Vault instance.
> > * **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
> > * **Role ID**: The Role ID generated in the steps above.
> > * **Secret ID**: The Secret ID generated in the steps above.
>
> > [tab] Access Token
> >
> > * **Name**: The name of the connection being created. Must be slug-friendly.
> > * **Description**: An optional description to provide details about this connection.
> > * **Gateway (optional):** The gateway connected to your private network. All requests made to your Vault instance will be made through the configured gateway.
> > * **Instance URL**: The URL of your HashiCorp Vault instance.
> > * **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
> > * **Access Token**: The Access Token generated in the steps above.
>
> **4. Connection Created**
>
> Your Vault Connection is now available for use.
>
> ![Vault Connection Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/hashicorp-vault/vault-infisical-connect-success.png)

> [tab] API
>
> To create a Vault Connection, make an API request to the [Create HashiCorp Vault
> Connection](https://infisical.com/docs/api-reference/endpoints/app-connections/hashicorp-vault/create.md) API endpoint.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl    --request POST \
>         --url https://app.infisical.com/api/v1/app-connections/hashicorp-vault \
>         --header 'Content-Type: application/json' \
>         --data '{
>             "name": "my-vault-connection",
>             "method": "app-role",
>             "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
>             "credentials": {
>                 "instanceUrl": "https://vault.example.com",
>                 "roleId": "4797c4fa-7794-71f0-c8b1-7c87759df5bf",
>                 "secretId": "ad24df93-19c8-c865-9997-6b8513253d3a"
>             }
>         }'
> ```
>
> ### Sample response
>
> ```bash Response theme={"dark"}
> {
>     "appConnection": {
>         "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "name": "my-vault-connection",
>         "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
>         "version": 1,
>         "orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "createdAt": "2025-04-01T05:31:56Z",
>         "updatedAt": "2025-04-01T05:31:56Z",
>         "app": "hashicorp-vault",
>         "method": "app-role",
>         "credentials": {
>             "instanceUrl": "https://vault.example.com",
>             "roleId": "4797c4fa-7794-71f0-c8b1-7c87759df5bf"
>         }
>     }
> }
> ```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.