> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret Providers

Secret providers allow the Maverics Orchestrator to retrieve sensitive values -- such as API keys, certificates, and database credentials -- from external secret management systems at runtime. This keeps secrets out of configuration files and ensures they are managed according to your organization's security policies.

> [!NOTE]
>
> **Console terminology:** In the Maverics Console, Orchestrator instances and
> configuration delivery are managed through **Deployments**. When working directly
> with YAML, configuration is managed as files delivered via the `-config` flag or
> `MAVERICS_CONFIG` environment variable.

## How Secret Providers Work

Secret providers are configured via the `MAVERICS_SECRET_PROVIDER` environment variable or the `-secretProvider` CLI flag -- not in YAML configuration. Only one secret provider may be active at a time.

```bash theme={null}
# Configure via environment variable
export MAVERICS_SECRET_PROVIDER="hashivault://vault.example.com:8200/secret/data/maverics?token=<token>"

# Or via CLI flag
maverics -config maverics.yaml -secretProvider "hashivault://vault.example.com:8200/secret/data/maverics?token=<token>"
```

Once a secret provider is configured, you reference secrets in your YAML configuration using angle bracket syntax:

```yaml theme={null}
connectors:
  - name: my-idp
    oauthClientSecret: <maverics.client_secret>
```

At startup (and on config reloads), the Orchestrator resolves `<maverics.client_secret>` by fetching it from the configured secret provider. The namespace (`maverics`) and key (`client_secret`) map to the secret path and key in the provider.

### Using Secret References in the Console

The same angle bracket syntax works in the Maverics Console. When configuring connectors, apps, or other resources in the Console, use secret references (e.g., `<maverics.client_secret>`) in any field that accepts a sensitive value. The Orchestrator resolves them at runtime just as it does with YAML.

> [!WARNING]
>
> Never enter actual secret values into the Console. Always use secret provider
> references instead. Configuration entered in the Console is stored as a
> deployment config -- secret references ensure that sensitive values remain in
> your secret management system and are never persisted in the configuration
> itself.

This applies even during testing. While you could enter plaintext values for local testing against non-production resources, we recommend using secret references from the start to build good habits. The [Secret File](/reference/orchestrator/configuration/secret-providers/environment) provider makes this easy -- point the Orchestrator at a local YAML file and reference those secrets in the Console the same way you would in production.

## Available Providers

| Provider | URL Scheme | Use Case |
| - | - | - |
| [AWS Secrets Manager](/reference/orchestrator/configuration/secret-providers/aws-secrets-manager) | `awssecretsmanager://` | AWS-native secret storage |
| [Azure Key Vault](/reference/orchestrator/configuration/secret-providers/azure-key-vault) | `azurekeyvault://` | Azure-native secret and certificate management |
| [CyberArk CCP](/reference/orchestrator/configuration/secret-providers/cyberark-ccp) | `cyberarkccp://` | CyberArk Central Credential Provider |
| [CyberArk Conjur](/reference/orchestrator/configuration/secret-providers/conjur) | `conjur://` | DevOps-oriented secrets for CI/CD and containers |
| [Delinea Secret Server](/reference/orchestrator/configuration/secret-providers/delinea) | `delinea://` | Enterprise privileged access management |
| [HashiCorp Vault](/reference/orchestrator/configuration/secret-providers/hashicorp-vault) | `hashivault://` | Enterprise secret management with dynamic secrets |
| [Secret File](/reference/orchestrator/configuration/secret-providers/environment) | `secretfile://` | Local file-based secrets for testing |

## Provider Pages

> **[AWS Secrets Manager](/reference/orchestrator/configuration/secret-providers/aws-secrets-manager)**
>
> AWS-native secret storage

> **[Azure Key Vault](/reference/orchestrator/configuration/secret-providers/azure-key-vault)**
>
> Azure-native secret and certificate management

> **[CyberArk CCP](/reference/orchestrator/configuration/secret-providers/cyberark-ccp)**
>
> CyberArk Central Credential Provider

> **[CyberArk Conjur](/reference/orchestrator/configuration/secret-providers/conjur)**
>
> DevOps-oriented secrets for CI/CD and containers

> **[Delinea Secret Server](/reference/orchestrator/configuration/secret-providers/delinea)**
>
> Enterprise privileged access management

> **[HashiCorp Vault](/reference/orchestrator/configuration/secret-providers/hashicorp-vault)**
>
> Enterprise secret management with dynamic secrets

> **[Secret File](/reference/orchestrator/configuration/secret-providers/environment)**
>
> Local file-based secrets for testing

## Related Pages

> **[Identity Fabric](/reference/orchestrator/identity-fabric)**
>
> Identity provider integrations

> **[Config Sources](/reference/orchestrator/configuration/config-sources)**
>
> Where the Orchestrator reads its configuration