What it does
Vault centralizes application secrets such as credentials, certificates, and encryption keys. Its secrets engines can store values or connect to other services to generate credentials dynamically, while authentication methods and policies control who can request them. Teams can use the self-managed Community or Enterprise edition, or choose a separate managed HCP Vault offering.
Start with a development server
Vault's operations quick start demonstrates a local development-mode server, authentication, and a first key-value secret that can be stored and retrieved. A developer can use this to understand the CLI and policy flow before wiring an application or CI job to Vault. For example, a pipeline could authenticate with its configured workload identity, read an application secret from an allowed path, and pass it only to the build step that needs it. That example is illustrative, not an executed integration.
Secrets engines extend the pattern: some store and return data, while others connect to a service and generate dynamic credentials. A production design needs more than a successful local read. Vault's docs warn that development mode stores data in memory and is insecure for production; operators must plan persistent storage, authentication, policies, TLS, backup, and recovery for a real deployment.
HashiCorp documents Community and Enterprise editions, with Enterprise features such as disaster recovery and advanced event management. HCP Vault Dedicated is a separate hosted form. Choose between self-managed Vault and the hosted service based on the operational responsibility your team can take on; the documented editions have different capabilities.
Strengths
- Centralizes credentials, certificates, and other sensitive values for application access.
- Secrets engines can store values or generate credentials by connecting to other services.
- The official quick start provides a local path for learning authentication, key-value secrets, and policies.
Watch out for
- The documented development mode is in-memory and explicitly unsuitable for production.
- A production installation requires an operator to plan storage, authentication, policies, and recovery.
Best for
- Centralizing application secrets for controlled retrieval by services and CI jobs
- Issuing dynamic credentials through configured secrets engines
- Teams that need a self-managed secrets service and can operate its production infrastructure
Sources
- What is Vault? | Vault | HashiCorp Developer (Oct 25, 2026)
- Operations quick start | Vault | HashiCorp Developer (Oct 25, 2026)
- Secrets engines | Vault | HashiCorp Developer (Oct 25, 2026)
- Understand available Vault editions | Vault | HashiCorp Developer (Oct 25, 2026)