> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup

> Step-by-step guide to connecting HashiCorp Vault to Prizm using App Role authentication so connector credentials are retrieved at runtime.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "HashiCorp Vault Setup",
            "description": "Step-by-step guide to connecting HashiCorp Vault to Prizm using App Role authentication so connector credentials are retrieved at runtime.",
            "url": "https://docs.dqlabs.ai/integrations/hashicorp-vault/setup",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## Connecting HashiCorp Vault to Prizm

Before starting, complete the [Vault prerequisites](/integrations/hashicorp-vault/prerequisites) to enable App Role authentication and generate a Role ID and Secret ID in your Vault instance.

<Steps>
  <Step title="Open Integration settings">
    Navigate to **Organization** → **Integration** and click **Add** to open the channel catalog. Click the **Vault** filter tab, then click the **HashiCorp** tile to open the configuration form.

    <Frame>
      <img src="https://mintcdn.com/dqlabs/GiXAkw4MyBAWLJHq/images/image-66.png?fit=max&auto=format&n=GiXAkw4MyBAWLJHq&q=85&s=d4ba8d0ee9283880d0f1a96d081cf105" alt="Image" width="2446" height="1186" data-path="images/image-66.png" />
    </Frame>
  </Step>

  <Step title="Enter a name and optional description">
    Enter a display **Name** for this vault connection (e.g., `Production Vault`). Optionally add a **Description** to distinguish it from other vault integrations.
  </Step>

  <Step title="Enter the Vault address">
    Enter the full URL of your Vault instance in **Vault Address**, including the port if non-standard:

    * **HCP Vault**: Your HCP Vault public cluster address (e.g., `https://vault-cluster.vault.hashicorp.cloud:8200`)
    * **Self-hosted**: `https://vault.yourcompany.com:8200`
  </Step>

  <Step title="Select authentication type and namespace">
    **Authentication Type** is pre-set to **App Role**. If you use HashiCorp Vault Enterprise with namespace isolation, enter the namespace in **Namespace** (e.g., `admin`). Leave blank for community or HCP Vault.
  </Step>

  <Step title="Enter Role ID and Secret ID">
    Paste the **Role ID** and **Secret ID** from the prerequisites step.
  </Step>

  <Step title="Enter the secret engine (optional)">
    If your secrets are stored under a non-default KV mount point (e.g., `kv` instead of `secret`), enter it in **Secret Engine**. Leave blank to use the default path.
  </Step>

  <Step title="Save the configuration">
    Click **Update Integration**. Prizm authenticates with Vault and confirms it can reach the configured paths.

    <Frame>
      <Frame>
        <img src="https://mintcdn.com/dqlabs/GiXAkw4MyBAWLJHq/images/image-68.png?fit=max&auto=format&n=GiXAkw4MyBAWLJHq&q=85&s=67541767117d868fb0eeded5fc13fe58" alt="Image" width="2402" height="1226" data-path="images/image-68.png" />
      </Frame>
    </Frame>
  </Step>
</Steps>

## Configuration reference

| Field                   | Required | Description                                                                                 |
| ----------------------- | -------- | ------------------------------------------------------------------------------------------- |
| **Name**                | Yes      | Display name for this Vault connection (e.g., `Production Vault`).                          |
| **Description**         | No       | Optional description to distinguish this integration from others.                           |
| **Vault Address**       | Yes      | Full URL of the Vault instance including port (e.g., `https://vault.yourcompany.com:8200`). |
| **Authentication Type** | Yes      | Pre-set to **App Role**.                                                                    |
| **Namespace**           | No       | Vault Enterprise namespace. Leave blank for community Vault.                                |
| **Role ID**             | Yes      | Static identifier for the App Role retrieved from Vault.                                    |
| **Secret ID**           | Yes      | Credential generated for the App Role. Treat as a password — rotate regularly.              |
| **Secret Engine**       | No       | KV engine mount path if non-default. Leave blank to use `secret/`.                          |

<Note>
  When you rotate the Secret ID in Vault, update it in Prizm before invalidating the old one to avoid connector authentication failures.
</Note>