Integrating Secrets Manager with your apps by using the Vault Dedicated plan
Ready to integrate IBM Cloud® Secrets Manager Vault Dedicated into your existing apps or services? Take advantage of our supported developer tools.
Supported developer tools
Secrets Manager instance management SDKs
Secrets Manager offers instance management software development kits (SDKs) for programmatic access to control plane operations for your Vault Dedicated instance. These SDKs cover instance management operations only — such as generating and revoking admin tokens and retrieving instance details. For runtime secrets operations, use the native Vault API directly. For more information, check out the following repositories on GitHub:
Secrets Manager instance management CLI plug-in
If you're already using the IBM Cloud Command Line Interface (CLI), you can install the Secrets Manager instance management plug-in to perform control plane operations on your Vault Dedicated instance from the command line, such as generating and revoking admin tokens and viewing instance details.
To install the Secrets Manager instance management CLI plug-in, run ibmcloud plugin install secrets-manager-instance-management.
For the full CLI reference, see Secrets Manager instance management CLI. For a history of changes, see the Secrets Manager instance management CLI change log.
Secrets Manager instance management API
The Secrets Manager instance management API provides control plane operations for your Vault Dedicated instance. It covers a focused set of operations: retrieving instance details, generating an admin token, and revoking admin tokens. It is not a runtime secrets API — for secrets operations such as reading and writing secrets, use the native Vault API directly against your Vault cluster endpoint.
For the full interactive API reference, including SDK code examples in Go, Node.js, Java, and Python, see the Instance Management API reference.
To call the instance management API, copy the control plane service endpoint URL from the Endpoints page in your Secrets Manager service dashboard and generate an IBM Cloud Identity and Access Management (IAM) token.
curl -X GET \
-H "Authorization: Bearer {access_token}" \
-H "Accept: application/json"
"{base_url}/api/v2/instance"
Replace {base_url} with your control plane service endpoint URL, and {access_token} with your IAM token.
Vault Agent
Vault Agent is a client-side daemon that runs alongside your application and handles authentication to your Vault Dedicated instance automatically. It manages token renewal and can retrieve secrets on behalf of your application, removing the need to write Vault authentication logic into your code.
Common uses include:
- Automatically authenticating to Vault using a configured auth method (such as AppRole or Kubernetes).
- Writing secrets to a file or template that your application reads directly.
- Renewing tokens before they expire, so your application always has valid access.
For more information, see the Vault Agent documentation.
Working with the Vault Dedicated plan
The Vault Dedicated plan provides a managed HashiCorp Vault Enterprise cluster. You can interact with your Secrets Manager Vault Dedicated instance by using the native Vault HTTP API or CLI.
For more information, check out the following HashiCorp resources:
HashiCorp Vault resources
Because Vault Dedicated uses the same binary as self-hosted Vault Enterprise, you can use the full HashiCorp documentation to configure and operate your instance. The following topics are most relevant for getting started.
Authentication
| Topic | Description |
|---|---|
| Tokens | Core concepts for Vault tokens, including token types, TTLs, and renewal. Essential background for working with admin tokens. |
| Auth methods overview | Overview of all supported authentication methods. Configure an auth method after initial setup so your teams and apps do not need to rely on the admin token. |
| Token auth method | Reference for the built-in token auth method. |
| AppRole auth method | The most common programmatic auth pattern for applications using Vault Dedicated. |
| Kubernetes auth method | Authenticate workloads running in Kubernetes clusters using service account tokens. |
Secrets engines
| Topic | Description |
|---|---|
| KV secrets engine v2 | Store and retrieve arbitrary static secrets. The core secrets engine for most Vault Dedicated users. |
| PKI secrets engine | Issue and manage X.509 certificates, including support for ACME clients. |
| Transit secrets engine | Encryption-as-a-service: encrypt, decrypt, sign, and verify data without exposing key material. |
| Database secrets engine | Generate dynamic, short-lived credentials for databases. |
| SSH secrets engine | Issue dynamic SSH credentials and signed certificates for secure host access. |
Policies and access control
| Topic | Description |
|---|---|
| Policies | Vault ACL policies with fine-grained path and operation-level authorization. |
| Sentinel policy enforcement | Code-based policy guardrails and compliance automation using Sentinel. |
| Control Groups | Human approval workflows for high-value operations. |
Namespaces
| Topic | Description |
|---|---|
| Namespaces | Namespace-based isolation for multi-team environments. |
| Namespace structure | Guidance for designing your namespace hierarchy across teams and workloads. |
Vault UI
| Topic | Description |
|---|---|
| Vault UI | Use the native Vault web interface to manage secrets engines, auth methods, policies, and namespaces in your Vault Dedicated instance. |
Audit logging
| Topic | Description |
|---|---|
| Audit devices | Configure Vault-side audit logging to capture a detailed record of all requests and responses in your instance. |
| Audit best practices | Guidance on structuring audit device configuration for production deployments. |