> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/2023-2/secrets/overview/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Secrets management overview

> Secure storage and retrieval of sensitive information in Itential Platform

## What is Secrets Management?

Secrets management is the secure storage, retrieval, and maintenance of sensitive information used to authenticate to external systems. Secrets include passwords, OAuth client secrets, SSH keys, TLS certificates, API tokens, and database connection strings.

Itential Platform integrates with several external systems. Secrets management ensures authentication credentials are stored, retrieved, updated, and deleted securely.

## Secrets Management Options

Platform supports multiple secrets management methods:

| Method                       | Storage Location         | Key Management            | Best For                                                           |
| ---------------------------- | ------------------------ | ------------------------- | ------------------------------------------------------------------ |
| Platform database encryption | MongoDB                  | You manage encryption key | Simple deployments, single secrets store                           |
| HashiCorp Vault              | External Vault server    | Vault-managed             | Enterprise deployments, existing Vault infrastructure              |
| OpenBao                      | External OpenBao server  | OpenBao-managed           | Open-source requirements, Vault-compatible API                     |
| CyberArk CCP                 | External CyberArk server | CyberArk-managed          | Enterprise credential management, existing CyberArk infrastructure |

### Platform Database Encryption

Platform encrypts sensitive data in MongoDB using your encryption key.

**Configuration:**

* `platform.properties`: `encryption_key` property
* Environment variable: `ENCRYPTION_KEY`

You manage and secure the encryption key and configure it using a platform property or environment variable. For information, see [platform properties and environment variables](/itential-platform/configure/environment-variables-properties-reference).

### HashiCorp Vault and OpenBao

Reference Vault or OpenBao secrets in adapters and integrations using `$SECRET_<path>` or `$KEY_<path>` syntax. Platform retrieves values at runtime.

**Requirements:**

* KV v2 secrets engine (KV v1 not supported)
* Vault namespaces not supported

**HashiCorp Vault vs OpenBao:**

* HashiCorp Vault: Enterprise license, HashiCorp support
* OpenBao: Open source (Apache 2.0), Vault-compatible API, community-driven

For installation, see [HashiCorp Vault](https://developer.hashicorp.com/vault/docs/install) or [OpenBao](https://openbao.org/docs/install/) documentation.

### CyberArk Integration

Configure adapters and integrations to retrieve credentials from CyberArk Central Credential Provider (CCP) at runtime.

### Workflow task Masking

Mask sensitive values in workflow task outputs and logs to prevent credentials from appearing in job history.

## Common Use Cases

**Adapter and integration authentication:** Secure credentials for ServiceNow, Jira, NetBox, AWS, Azure, and other external systems.

**Identity provider integration:** Secure OAuth client secrets, SAML certificates, and LDAP bind credentials for SSO configuration.

**HTTPS configuration:** Store TLS certificates and private keys for Platform HTTPS.

## Secrets Rotation

External secrets management systems do not automatically notify Platform of credential changes.

**To rotate secrets:**

Update the secret in your secrets management system

Restart the affected adapter or service

Verify connectivity to the external system

Plan maintenance windows to minimize disruption.

## Gateway Secrets Management

Itential Gateway has separate secrets management. For details, see [Configure Gateway secret store](/itential-gateway/configure-secret-store).

## Next Steps

#### [HashiCorp Vault](/itential-platform/secrets/hashicorp/overview)

Integrate with Vault or OpenBao

#### [CyberArk](/itential-platform/secrets/cyberark/overview)

Integrate with CyberArk CCP

> Secure storage and retrieval of sensitive information in Itential Platform