> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Use CyberArk secrets

> Reference secrets from CyberArk CCP in Platform configurations

Reference and use secrets from CyberArk CCP in Itential Platform configuration values and in Application, Adapter, and Integration properties.

Itential Platform has read-only access to CyberArk CCP. You cannot write secrets to CyberArk Digital Vault from Itential Platform.

## Secret reference format

Use this format to reference CyberArk secrets:

```
$SAFE_<SafeName> $NAME_<SecretName>
```

The format includes:

* `$SAFE_` followed by the CyberArk Safe name
* A space character
* `$NAME_` followed by the secret name

**Example:** `$SAFE_My-Safe $NAME_mongodb` retrieves the "mongodb" secret from the "My-Safe" safe.

## Configure Itential Platform

You cannot use CyberArk secret references to configure the Itential Platform connection to CyberArk CCP.

### Properties files

Add CyberArk references to system properties through platform properties or environment variables. See [Platform Properties and Environment Variables](/itential-platform/configure/environment-variables-properties-reference) for details.

**`Platform 6 (platform.properties)`**

```properties title="Platform 6 (platform.properties)"
mongo_auth_enabled=true
mongo_user=$SAFE_DavyJonesLocker $NAME_mongodb-user
mongo_password=$SAFE_DavyJonesLocker $NAME_mongodb-password
mongo_db_name=itential-platform-6
mongo_url=$SAFE_DavyJonesLocker $NAME_mongouri
```

**`Itential Platform 2023.2 (properties.json)`**

```json title="Itential Platform 2023.2 (properties.json)"
{
  "mongoProps": {
    "credentials": {
      "dbAuth": true,
      "user": "$SAFE_DavyJonesLocker $NAME_mongodb-user",
      "passwd": "$SAFE_DavyJonesLocker $NAME_mongodb-password"
    },
    "db": "itential-platform-23-2",
    "url": "$SAFE_DavyJonesLocker $NAME_mongouri"
  }
}
```

### Environment variables

Platform 6 only. Set environment-specific secrets using CyberArk references:

```bash
export ITENTIAL_MONGO_AUTH_ENABLED="true"
export ITENTIAL_MONGO_USER="$SAFE_DavyJonesLocker $NAME_mongodb-user"
export ITENTIAL_MONGO_PASSWORD="$SAFE_DavyJonesLocker $NAME_mongodb-password"
export ITENTIAL_MONGO_DB_NAME="itential-platform"
export ITENTIAL_MONGO_URL="$SAFE_DavyJonesLocker $NAME_mongouri"
```

### System profiles

#### Open Admin Essentials

Navigate to **Admin Essentials** and select **Profiles**.

#### Select the active profile

Select the active profile from the list.

#### Open configuration

Click the **Configure** tab.

#### Select property

Select a profile property to encrypt.

![Edit Profile properties](/_fern-img/c3e38df005c09f7921a379daf008249f9e190ee494a59437143b6c0ec8df8298.webp)

#### Add CyberArk reference

Replace the value with a CyberArk reference.

#### Save and restart

Save the configuration and restart Itential Platform.

## Configure applications, adapters, and integrations

The following example uses an Adapter instance. The same steps apply to Applications and Integrations.

### Using configuration form

#### Open Admin Essentials

Navigate to **Admin Essentials** and select **Adapters**.

#### Select adapter

Select your adapter from the list.

#### Replace sensitive values

Replace sensitive values in the property configuration form with CyberArk references.

#### Save configuration

Click **Save**. The adapter restarts automatically and retrieves the secret.

![Adapter connection status](/_fern-img/00a50e92476eed4abb338e832803a7254f1a6eef72d3a844d58269f894418e40.webp)

### Using advanced view

#### Open Admin Essentials

Navigate to **Admin Essentials** and select **Adapters**.

#### Select adapter

Select your adapter from the list.

#### Enable advanced view

Click the **Advanced View** toggle in the upper-right to access the JSON configuration.

#### Replace sensitive values

Replace sensitive values with CyberArk references.

#### Save configuration

Click **Save**. The adapter restarts automatically and retrieves the secret.

## Next steps

#### [Configure](/itential-platform/secrets/cyberark/set-up)

Review configuration

#### [Troubleshoot](/itential-platform/secrets/cyberark/monitor-troubleshoot)

Resolve common issues