Skip to main content
Bruno allows you to integrate: as your secret provider. You can configure the secret provider from the Preferences settings in the Secrets Manager section.

​
Setting Up Vault Server

To configure a Vault server secret provider, you can opt for either Token or AppRole authentication.
  1. Go to the Preferences settings and navigate to the Secrets Manager section.
  2. Click on the + Add Secret Manager button.
  3. Select HashiCorp Vault Server as the provider type and choose an authentication method:
    • Token - authenticate using a static Vault token. Simplest to set up; suitable for local development and trusted environments.
    • App Role - authenticate using a Role ID and Secret ID pair. Recommended for automated pipelines and CI/CD where a personal token is not appropriate.
    • LDAP - authenticate using an LDAP username and password. Use when your Vault instance is backed by an LDAP/Active Directory identity provider.
  4. Enter http://localhost:8200 if using a local server, or the URL of the hosted server (e.g., https://vault.example.com).
  5. Provide the necessary Token ↗ or AppRole ↗ credentials.
  6. Click on Add to save the secret provider.
config-vault
Click on Test Connection to verify the connection to the Vault server.

​
Setting up Vault Cloud

To set up a HashiCorp Vault Cloud secret provider, follow these steps:
  1. Go to the Preferences settings and navigate to the Secrets Manager section.
  2. Click on the + Add Secret Manager button.
  3. Select HashiCorp Vault Cloud as the provider type.
  4. Maintain the default settings for Token Endpoint and Secrets Endpoint, or modify them if necessary.
  5. Provide the required Client Credentials ↗.
  6. Add one or more Projects (Apps) to the secret provider.
  7. Click on Add to save the secret provider.
config-vault-cloud

​
Exporting as a .env file

Once a provider is saved, you can export its configuration as a .env file directly from Preferences > Secrets Manager. This is useful for sharing credentials with the Bruno CLI or seeding a CI/CD pipeline without manually transcribing values.
  1. In the Secrets Manager list, hover over the account you want to export.
  2. Click the Export as .env icon (the square-with-arrow icon on the right).
  3. Bruno writes the credentials to a .env file on your machine.
export-as-env
The exported .env file contains your vault credentials in plain text. Add it to .gitignore immediately and never commit it to version control.
Pass the exported file to the CLI using the --secrets-env-file flag:
See Secret Managers in Bruno CLI for full credential file formats and usage.