> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebruno.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret Managers

> Fetch secrets from HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault directly in Bruno CLI runs.

Bruno CLI supports pulling secrets at runtime from external secret managers so that credentials never need to be stored in your collection files or passed as plain-text arguments.

**Supported providers (v4.0.0+):**

* HashiCorp Vault (Vault Server and HCP Vault)
* AWS Secrets Manager
* Azure Key Vault

<Warning>
  **Breaking change in v4.0.0**

  * Secret Manager configuration has moved out of `secrets.json` and into your environment files (`.bru` / `environment.yml`) under an `externalSecrets` block. Secret Manager is now configured from the **Environment UI**, not from Collection Settings.

  * **Migration is automatic in the app.** When you open a collection that still has a `secrets.json`, Bruno migrates it to the environment file in the background. No manual step is needed.

  * **The CLI does not auto-migrate.** If the CLI finds a `secrets.json` but no `externalSecrets` block in the environment file, it prints a warning and asks you to open the collection in the app first to complete the migration.

  See the [Secret Managers migration guide](/secrets-management/secret-managers/migration) for full details.
</Warning>

## Variable syntax

After migration, secrets are referenced with the new syntax:

```
{{name.keyname}}
```

The legacy syntax `{{$secrets.name.keyname}}` still resolves in v4 and will continue to work until the next major release. It is shown with a deprecation underline and hover tooltip in the app pointing to the new syntax. An in-app tool to automatically rewrite all `{{$secrets.*}}` references to the new syntax will be available in **v4.2.0**.

## How it works

1. Configure a secret manager on an environment in the app (Environment UI → External Secrets).
2. Commit the updated environment file to your repository.
3. Run the CLI with `--env <EnvironmentName>` and pass credentials via `--secrets-env-file`.

```bash theme={null}
bru run collection/ --env Production --secrets-env-file ./secrets.env
```

The `--secrets-env-file` flag accepts a dotenv-style file containing the credentials for your secret provider. Secrets are fetched at runtime, injected into the variable resolution chain, and are **never written to disk or printed in logs**.

<Tip>
  You can export a `.env` credential file directly from Bruno's UI without manually writing one. Go to **Preferences** > **Secrets Manager**, hover over any configured account, and click the **Export as .env** icon.

  The exported file is ready to pass straight to `--secrets-env-file`. Keep it out of version control. Learn more about [exporting as .env file](/secrets-management/secret-managers/hashicorp-vault/adding-a-secret-provider#exporting-as-a-env-file).
</Tip>

### Variable precedence

```
External secrets
    ↓
Secret env vars (--secrets-env-file)
    ↓
Environment variables (--env)
    ↓
Collection / Workspace / Global env
```

***

## HashiCorp Vault

Supported authentication methods: **Token**, **AppRole**, **Client Credentials** (HCP Vault).

### Vault Server — Token authentication

Configure in the app and then run:

```bash theme={null}
bru run collection/ --env Prod --env-var authToken=your-vault-token
```

Legacy `secrets.json` equivalent (pre-v4, for reference):

```json theme={null}
{
  "type": "vault",
  "cli": {
    "type": "vault-server",
    "vaultServerConfig": {
      "url": "http://localhost:8200",
      "namespace": "bruno",
      "auth": {
        "method": "token",
        "token": "{{authToken}}"
      }
    }
  },
  "data": [
    {
      "environment": "Prod",
      "secrets": [{ "name": "db", "path": "secret/db", "enabled": true }]
    }
  ]
}
```

### Vault Server — AppRole authentication

```bash theme={null}
bru run collection/ --env Prod \
  --env-var roleId=your-role-id \
  --env-var secretId=your-secret-id
```

Legacy `secrets.json` equivalent:

```json theme={null}
{
  "type": "vault",
  "cli": {
    "type": "vault-server",
    "vaultServerConfig": {
      "url": "http://localhost:8200",
      "namespace": "bruno",
      "auth": {
        "method": "app_role",
        "appRole": {
          "role": "bruno",
          "roleId": "{{roleId}}",
          "secretId": "{{secretId}}"
        }
      }
    }
  },
  "data": [
    {
      "environment": "Prod",
      "secrets": [{ "name": "db", "path": "secret/db", "enabled": true }]
    }
  ]
}
```

### HCP Vault — Client credentials authentication

```bash theme={null}
bru run collection/ --env Prod \
  --env-var tokenEndpoint=your-token-endpoint \
  --env-var secretsEndpoint=your-secrets-endpoint \
  --env-var clientId=your-client-id \
  --env-var clientSecret=your-client-secret \
  --env-var projectName=your-project-name \
  --env-var projectId=your-project-id \
  --env-var organizationId=your-organization-id
```

***

## AWS Secrets Manager

<Note>
  Available from v4.0.0. Requires the `externalSecrets` block in the environment file — configure it from the Environment UI in the app first.
</Note>

### Credential file

Create a dotenv file (e.g. `secrets.env`) with your AWS credentials:

```bash theme={null}
BRUNO_AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
BRUNO_AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
BRUNO_AWS_SESSION_TOKEN=FwoGZXIvYXdzEBYaDH...   # optional, for temporary credentials
BRUNO_AWS_REGION=us-east-1
```

`BRUNO_AWS_SESSION_TOKEN` is only required when using temporary credentials or an assumed IAM role.

If `BRUNO_AWS_*` variables are not present, the CLI falls back to the standard AWS environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `AWS_REGION`).

### CLI command

```bash theme={null}
bru run collection/ --env Production --secrets-env-file ./secrets.env
```

### Referencing secrets

After configuring the `aws-secrets-manager` provider in the Environment UI, reference secrets in your requests with:

```
{{secretName.keyName}}
```

For example, if your AWS secret is named `prod/db` and contains `{ "password": "s3cr3t" }`, reference it as `{{prod/db.password}}`.

Both syntaxes resolve:

| Syntax                      | Status                                                                 |
| --------------------------- | ---------------------------------------------------------------------- |
| `{{name.keyname}}`          | Recommended (v4+)                                                      |
| `{{$secrets.name.keyname}}` | Deprecated — still works in v4, removal planned for next major release |

***

## Azure Key Vault

<Note>
  Available from v4.0.0. Requires the `externalSecrets` block in the environment file — configure it from the Environment UI in the app first.
</Note>

Two authentication methods are supported: **Service Principal** and **Azure CLI**.

### Service Principal — credential file

Create a dotenv file with your Service Principal credentials:

```bash theme={null}
BRUNO_AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
BRUNO_AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
BRUNO_AZURE_CLIENT_SECRET=your-client-secret
```

### Azure CLI auth

If you are already logged in with `az login`, set the auth method to `cli` in the credential file — no other Azure credentials are needed:

```bash theme={null}
BRUNO_AZURE_AUTH_METHOD=cli
```

The CLI uses your active `az login` session to authenticate against Key Vault.

If `BRUNO_AZURE_*` variables are not present, the CLI falls back to the standard Azure environment variables (`AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`).

### CLI command

```bash theme={null}
bru run collection/ --env Production --secrets-env-file ./secrets.env
```

### Referencing secrets

After configuring the `azure-key-vault` provider in the Environment UI, reference secrets in your requests with:

```
{{vaultName.secretName}}
```

Both syntaxes resolve:

| Syntax                      | Status                                                                 |
| --------------------------- | ---------------------------------------------------------------------- |
| `{{name.keyname}}`          | Recommended (v4+)                                                      |
| `{{$secrets.name.keyname}}` | Deprecated — still works in v4, removal planned for next major release |

***

## Security notes

* Secret values are **never written to disk** and **never printed in logs** or CLI output.
* The `--secrets-env-file` path should point to a file that is in `.gitignore` and not committed to version control.
* Use environment-specific credential files when running across multiple environments in CI/CD pipelines.