Vault

Integrate with HashiCorp Vault to securely resolve environment variables from your Vault servers. Vault works through environments — variables marked as Vault-sourced in Atrahasis Pro are automatically fetched at runtime.

How It Works

Vault + Environment

Vault integration is driven by environments. When you create an environment in Atrahasis Pro, you can set any variable's source to Vault. At runtime, atra resolves those variables by fetching secrets from your Vault server.

1Configure Vault-sourced variables in Atrahasis Pro (connection, path, key)
2Provide Vault credentials when running with atra
3atra fetches secrets from Vault and injects them as environment variables

Single Vault Connection

Token Authentication

Pass Vault credentials with VAULT_AUTH at the end of the command. Format: token@url.

# Flow with Vault token auth

atra run flow-folder -e dev VAULT_AUTH="hvs.token@https://vault.example.com"

# Load test with Vault token auth

atra run spec-folder -e dev VAULT_AUTH="hvs.token@https://vault.example.com"

Userpass Authentication

Use username:password@url format for userpass authentication.

# Flow with userpass auth

atra run flow-folder -e dev VAULT_AUTH="admin:secret@https://vault.example.com"

# Load test with userpass auth

atra run spec-folder -e dev VAULT_AUTH="admin:secret@https://vault.example.com"

Multiple Vault Connections

Named Connections

Connect to multiple Vault servers using VAULT_AUTH_<NAME>. The name matches the connection name configured in your environment. Each connection can use its own authentication method.

# Two Vault servers, both using token auth

atra run flow-folder -e dev \

VAULT_AUTH_FIRSTVAULT="hvs.token@https://vault-1.example.com" \

VAULT_AUTH_SECONDVAULT="hvs.token@https://vault-2.example.com"

# Mixed auth methods — token + userpass

atra run spec-folder -e dev \

VAULT_AUTH_FIRSTVAULT="admin:secret@https://vault-1.example.com" \

VAULT_AUTH_SECONDVAULT="hvs.token@https://vault-2.example.com"

Note: Connection names are case-insensitive. VAULT_AUTH_PROD and VAULT_AUTH_prod resolve to the same connection.

Supported Features

Vault Capabilities

AuthToken and Userpass authentication methods
KVKV v1 and KV v2 secret engines (auto-detected)
TypesString, number, float, and boolean secret values
MultiMultiple Vault connections in a single run

Quick Reference

Vault Auth Format

VariableFormatDescription
VAULT_AUTHcredentials@urlDefault Vault connection
VAULT_AUTH_<NAME>credentials@urlNamed Vault connection
token@urlToken authentication
username:password@urlUserpass authentication
EnvironmentsAuto Update