> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/2023-2/secrets/hashicorp/manually-encrypt/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Manually encrypt properties

> Use the $SECRET syntax for specific key encryption

You can encrypt specific keys in Vault using the `$SECRET` syntax.

## Encrypt adapter properties

### Create secret in Vault

Create a `path` and `key name` in Vault for the item. Use a path and key name that clearly relates to the target item.

### Open adapter configuration

Go to **Admin Essentials**, click **Adapters**, and select an adapter.

### Enable Advanced View

Click the **Advanced View** toggle to see the JSON configuration, which may be easier to edit.

### Replace value with reference

Remove the existing value and replace it with the Vault reference:

```
"$SECRET_<path> $KEY_<key>"
```

For example: `"$SECRET_default_password $KEY_key"` evaluates to `"password"`.

**Note:** Include a space before `$KEY_`.

### Save configuration

Click **Save**. The adapter automatically restarts and uses Vault to decrypt the property.

### Verify connection

The adapter should appear in the list with a green status indicator and connection icons.

## Encrypt integration properties

### Create secret in Vault

Create a `path` and `key name` in Vault for the item. Use a path and key name that clearly relates to the target item.

### Open integration configuration

Go to **Admin Essentials**, click **Integrations**, and select an integration.

### Locate property

Find the value you want to encrypt.

### Enable Advanced View

Click the **Advanced View** toggle to see the JSON configuration.

### Replace value with reference

Remove the existing value and replace it with the Vault reference:

```
"$SECRET_<path> $KEY_<key>"
```

For example: `"$SECRET_default_password $KEY_key"` evaluates to `"password"`.

**Note:** Include a space before `$KEY_`.

### Save configuration

Click **Save**. The integration automatically restarts and uses Vault to decrypt the property.

## Encrypt profile properties

### Create secret in Vault

Create a `path` and `key name` in Vault for the item. Use a path and key name that clearly relates to the target item.

### Open profile configuration

Go to **Admin Essentials**, click **Profiles**, and select the currently running profile.

### Select property

Click the **Configure** tab and select a profile property to encrypt.

### Replace value with reference

Remove the existing value and replace it with the Vault reference:

```
"$SECRET_<path> $KEY_<key>"
```

For example: `"$SECRET_default_password $KEY_key"` evaluates to `"password"`.

**Note:** Include a space before `$KEY_`.

### Save configuration

Click **Save** to finalize the profile property changes.

### Restart platform

Restart Itential Platform for the changes to take effect.

## Encrypt properties.json values

### Create secret in Vault

Create a `path` and `key name` in Vault for the item. Use a path and key name that clearly relates to the target item.

### Open properties.json

Open the `properties.json` file and select a property to encrypt, such as `"mongoProps.credentials.passwd"`.

You cannot encrypt any `vaultProps` values within `properties.json`.

### Replace value with reference

Remove the existing value and replace it with the Vault reference:

```
"$SECRET_<path> $KEY_<key>"
```

For example: `"$SECRET_default_password $KEY_key"` evaluates to `"password"`.

**Note:** Include a space before `$KEY_`.

### Save file

Save the document.

### Restart platform

Restart Itential Platform for the changes to take effect.

## Next steps

#### [Automatic encryption](/itential-platform/secrets/hashicorp/automatically-encrypt-properties)

#### [Create secrets](./create-secrets)

> Use the $SECRET syntax for specific key encryption