Use a vault for secrets

Need to provide secrets such as credentials to your robot? You can use a vault. Both local and Robocorp Cloud vault is supported.

To better show you how to set up the vault, we have provided an example robot for you to play with.

Setting the robot up to run locally

Local vault

Create a vault.json file. Place it outside your repository, for example, in your home directory (/Users/<your-username>/vault.json). Never commit your vault file.

Provide your vault values in the vault.json file, for example:

{
  "credentials": {
    "username": "some-username",
    "password": "some-password"
  }
}

By doing so, you have created a secret called credentials.

You can use any name for the vault file and the keys in the file.

Configure file vault support

When running in Robocorp Cloud, your robot will automatically use the Robocorp Cloud vault, without the need for any configuration.

When running your robot locally, you will need to override this default configuration to tell the library that it should read the secrets from a local file. You do this by setting the relevant environment variables in the devdata/env.json file, which is included in the example.

Edit the file setting the RPA_SECRET_FILE variable so that it points to the vault.json file you created in the previous step:

{
  "RPA_SECRET_MANAGER": "RPA.Robocloud.Secrets.FileSecrets",
  "RPA_SECRET_FILE": "/Users/<your-username-here>/vault.json"
}

This way, with no additional code changes, your robot will work both locally and in Robocorp Cloud.

NOTE FOR RCC USERS: Robocorp Lab and the Robocorp VS Code extension will pick up the devdata/env.json file automatically. While using RCC locally, you have to explicitly point to the file using the -e argument like so: rcc run -e devdata/env.json.

Read the vault values - Option 1: Robot script

We added the RPA.Robocloud.Secrets library in the *** Settings *** section:

*** Settings ***
Library    RPA.Robocloud.Secrets

We use the Get Secret keyword from the RPA.Robocloud.Secrets library to fetch a secret by name credentials and store the secret to a variable. We can then access the properties of the secret by their name:

*** Tasks ***
Get and log the value of the vault secrets using the Get Secret keyword
    ${secret}=    Get Secret    credentials
    # Note: in real robots, you should not print secrets to the log. this is just for demonstration purposes :)
    Log    ${secret}[username]
    Log    ${secret}[password]

Read the vault values - Option 2: Python library

In the file variables/variables.py, we import the RPA Framework secrets library and read the values from the vault:

from RPA.Robocloud.Secrets import Secrets

secrets = Secrets()
USER_NAME = secrets.get_secret("credentials")["username"]
PASSWORD = secrets.get_secret("credentials")["password"]

After this, ${USER_NAME} and ${PASSWORD} variables can be accessed in the robot script, as we see here:

*** Tasks ***
Get and log the value of the vault secrets using the imported variables file
    # Note: in real robots, you should not print secrets to the log. this is just for demonstration purposes :)
    # This works because we are importing the `variables.py` file:
    Log    ${USER_NAME}
    Log    ${PASSWORD}

The RPA Framework secrets library handles both local and Robocorp Cloud vault. It looks for the RPA_SECRET_MANAGER environment variable and defaults to Robocorp Cloud vault.

Robocorp Cloud vault

Configure your vault in Robocorp Cloud in the relevant workspace using the UI. The name of the secret should match the name used in your code that reads the secret, for example, credentials. Provide the secrets as key-value pairs.