> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/authentication/hashicorp-vault-ssh-credentials.md).

# HashiCorp Vault — Fetch SSH Credentials at Connect Time

Tempest can pull SSH credentials from **HashiCorp Vault** the moment you connect, instead of storing a static private key or password locally. Add a Vault connection once, then point any SSH host at it — Tempest talks to Vault directly (desktop, CLI, and mobile all share the same client) and nothing beyond the Vault token itself lives on disk.

Vault identities and Tempest's built-in Keychain are two parallel, unrelated credential types — switch between them with the mode selector at the top of the **Keychain** panel (Keychain / HashiCorp Vault). Once created, a Vault identity is selectable from any SSH host's **Auth Method → HashiCorp Vault**.

## Two modes

Tempest supports two ways of getting a credential out of Vault:

### SSH Certificate Signing (recommended)

Tempest keeps a normal SSH keypair locally — the private key never leaves your device. On connect, it sends the **public** key to Vault's [SSH secrets engine](https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates), and Vault signs it into a short-lived OpenSSH certificate. Tempest authenticates with that certificate.

* No long-lived secret to leak — a signed certificate typically expires in minutes to hours, set by the Vault role.
* The private key is generated and stored the same way as any other Tempest SSH key (Ed25519/ECDSA/RSA, optional passphrase) — Vault never sees it.
* Requires the target server to trust your Vault SSH CA (`vault write ssh/config/ca` + the server's `sshd` trusting the CA public key via `TrustedUserCAKeys`).

### KV v2 secret read

Tempest reads a static secret out of a [KV v2](https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2) mount and maps its fields to a username, password, and/or private key + passphrase. Use this if you're not running the SSH secrets engine and just want Tempest to pull an existing password or key out of Vault instead of pasting it into Tempest directly.

## Set up a Vault connection

1. Open **Keychain** in the sidebar, switch the mode selector at the top to **HashiCorp Vault**, and click **New**.
2. Fill in:
   * **Vault Address** — e.g. `https://vault.example.com:8200`
   * **Token** — a Vault token with read access to the mount/role you'll use
   * **Namespace** *(optional)* — Vault Enterprise namespace, sent as `X-Vault-Namespace`
   * **CA Certificate** *(optional, PEM)* — only needed for a self-signed or internal-CA Vault deployment
   * **Username** *(optional)* — overrides the login username applied to the SSH connection using this identity
3. Pick a **Source**:
   * **SSH Certificate Signing** — set the **SSH Secrets Mount** (e.g. `ssh`) and **SSH Role**, then generate or paste the local keypair Vault will sign. The role's `default_extensions` control what the resulting session is allowed to do (PTY, port forwarding, agent forwarding) — if those look "authenticated but broken," check the role config in Vault, not Tempest.
   * **KV v2** — set the **KV Mount** and **path**, then map whichever of `username` / `password` / `private_key` / `passphrase` field names your secret uses.
4. Click **Test Connection** to confirm Tempest can reach Vault and read the role/path before saving.
5. On any SSH host, set **Auth Method → HashiCorp Vault** and pick this connection.

## Where the token lives

The Vault token itself is stored alongside your other Tempest credentials, under the same end-to-end encryption as everything else in your vault documents (see [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials.md)). It's a **static token** — Tempest doesn't currently drive a Vault login flow (AppRole, OIDC, etc.), so provisioning and rotating the token is on you, e.g. via your own Vault policy TTLs or a periodic token renewal outside of Tempest.

## Enterprise feature

Vault credential integration requires **Tempest Enterprise**.

## See also

* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials.md)
* [YubiKey & FIDO2 SSH Authentication](/authentication/yubikey-fido2-ssh-authentication.md) — another way to keep private key material off disk entirely
* [Post-Quantum SSH Algorithms (PQC)](/authentication/post-quantum-ssh-algorithms.md)