> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Overview
> What the HashiCorp Vault integration does and how Prizm retrieves credentials using App Role authentication.
## What is the HashiCorp Vault integration?
The HashiCorp Vault integration connects Prizm to HashiCorp Vault using the App Role authentication method, enabling Prizm to retrieve connector credentials — passwords, API tokens, connection strings — directly from Vault at runtime. Credentials are never stored in Prizm; they are fetched from Vault each time a connector needs to establish a connection. This allows organizations with a centralized secrets management practice to extend that practice to their data quality platform.
### What this integration enables
| Capability | Description |
| ------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Dynamic credential retrieval | Prizm fetches credentials from Vault at connection time rather than storing them. |
| HCP Cloud and self-hosted Vault | Compatible with HashiCorp Cloud Platform (HCP) and self-hosted Vault deployments. |
| Namespace isolation | Supports Vault Enterprise namespaces for multi-tenant Vault deployments. |
| Zero credential storage | Credentials are never persisted in Prizm's database. |
| Automatic rotation | When a credential is rotated in Vault, connectors in Prizm pick up the new value on the next connection. |
### Using HashiCorp Vault with Prizm
Once the HashiCorp Vault integration is active, it becomes available as a credential source when creating or editing connectors in Prizm. Instead of entering a password or API token directly, you select the Vault integration and specify where in Vault the credential lives. Prizm fetches it at runtime and does not cache it.
When creating or editing a connector — for example, a Snowflake or PostgreSQL connector — locate the **Credentials** section. Instead of entering a password directly, click **Use Vault** and select the HashiCorp Vault integration you configured. Enter the secret key name within the Vault path (for example, if the secret at `secret/data/prizm/snowflake-prod` contains a field named `password`, enter `password` as the key). Save the connector. Prizm retrieves the credential from Vault each time the connector establishes a connection.
### How credential retrieval works at runtime
When Prizm needs to connect to a data source through a Vault-backed connector, it authenticates with Vault using the configured Role ID and Secret ID to obtain a short-lived Vault token. It then reads the secret at the configured path and extracts the specified key. The retrieved credential is used for the connection and is not stored anywhere in Prizm after the connection is established.
### Credential rotation
When a credential is rotated in Vault, update the secret value at the same Vault path and key. No changes are needed in Prizm. The next time the connector establishes a connection, Prizm fetches the new credential from Vault automatically, making Vault-backed connectors fully compatible with automated credential rotation policies.
Use separate Vault paths for each environment (e.g., `secret/data/prizm/snowflake-prod` and `secret/data/prizm/snowflake-staging`) and create separate App Role policies scoped to each path. This limits the blast radius if a Secret ID is ever compromised — the integration can only read secrets in its own environment's path.
Connect HashiCorp Vault to Prizm — step-by-step configuration guide.