Skip to main content
Starting from Bruno v4.0.0, the configuration of secret managers has moved from Collection > Secrets to Environment > External Secrets tab.
Fetching and storage
  • Fetch Secrets loads values into a per-environment, in-memory cache for the session only.
  • Secret values are never written to disk — only provider config and identifiers are saved.
  • Closing the app or collection clears the cache. Reopen Bruno and it will fetch secrets on demand.
  1. Go to Environment > External Secrets and select the secret manager you want to configure.
external-secret-overview
  1. You will see the configured Secret Manager accounts list from Preferences settings. Select the Account you want to configure.
select-account-secret-manager
  1. Enter Name and Path for the secret you want to fetch.
  • Name — the name you will use to reference the secret in Bruno, e.g. usebruno
  • Path — the Vault API path of the secret, without the leading /v1/. Bruno sends this path to Vault as-is, so it must begin with the mount path of your KV secrets engine. The default mount is secret/, but your Vault admin may have mounted the engine anywhere, e.g. kv/ or team-a/.
    • KV v2 engines (the default in Vault dev mode): include the data/ segment, <mount>/data/<secret-path>, e.g. secret/data/api-key
    • KV v1 engines: no data/ segment, <mount>/<secret-path>, e.g. secret/api-key
Not sure of your mount path or KV version? Run vault secrets list -detailed to see mounts and their version option, or vault kv get -output-curl-string <mount>/<secret-path> to print the exact API path Vault expects. Use that path minus the /v1/ prefix.
enter-name-path
  1. Click on the Fetch Secrets button on the top right corner.
  2. Fetched secret keys appear under Secret Keys. Values stay in the in-memory session cache and are not persisted to disk.
Use three dots menu to:
  • Edit account to edit the account details
  • Remove secret manager to remove the secret manager configuration
edit-account