# Vault

Use this mountpoint to store Cypher secrets in a Hashicorp Vault server backend rather than VM Essentials. Additionally, you can call secrets stored in Vault from this Cypher mountpoint even if they are only saved there and not listed in the VM Essentials Cypher UI. This requires installation and configuration of the Hashicorp Vault plugin. See the YouTube video embedded in this section for more information on adding the plugin, configuration, and a demonstration of its capabilities.

NOTE

It’s recommended that you use a long-lived token as attempts to call Vault-stored values into Tasks will stop working if the token is no longer good. In such a case you’d have to obtain a new token, delete the Cypher entry with the old token, and create a new one to restore functionality once again. Using a long-lived token will prevent the need to do this often.

Key
:   Pattern “vault/<engineMount>/<secretPath>/data/<key>” (ex. vault/KV2/secret/data/morpheus/lab)

Value
:   Enter your key/value pair here in valid JSON (ex. {“hello”: “world”} )

Lease
:   Enter lease time in seconds (ex. 604800 for one week)

Click SAVE CHANGES. The example BASH script below onboards the value stored in Vault from the secret/data/morpheus/lab mountpoint:

```
```
from_vault="<%= cypher.read('vault/KV2/secret/data/morpheus/lab') %>"  
echo $from_vault
```
```
