Use a vault for secrets

Need to provide secrets such as credentials to your robot? You can use a vault. Both local and Control Room vault is supported.

To better show you how to set up the vault, we have provided an example robot for you to play with.

Setting the robot up to run locally

Local vault

Create a vault.json file. Place it outside your repository, for example, in your home directory (/Users/<your-username>/vault.json). Never commit your vault file.

Provide your vault values in the vault.json file, for example:

{
  "credentials": {
    "username": "some-username",
    "password": "some-password"
  }
}

By doing so, you have created a secret called credentials.

You can use any name for the vault file and the keys in the file.

Configure file vault support

When running in Control Room, your robot will automatically use the Control Room vault, without the need for any configuration.

When running your robot locally, you will need to override this default configuration to tell the library that it should read the secrets from a local file. You do this by setting the relevant environment variables in the devdata/env.json file, which is included in the example.

Edit the file setting the RPA_SECRET_FILE variable so that it points to the vault.json file you created in the previous step:

{
  "RPA_SECRET_MANAGER": "RPA.Robocorp.Vault.FileSecrets",
  "RPA_SECRET_FILE": "/Users/<your-username-here>/vault.json"
}

This way, with no additional code changes, your robot will work both locally and in Control Room.

NOTE FOR RCC USERS: Robocorp Lab and the Robocorp VS Code extension will pick up the devdata/env.json file automatically. While using RCC locally, you have to explicitly point to the file using the -e argument like so: rcc run -e devdata/env.json.

Read the vault values - Option 1: Robot script

We added the RPA.Robocorp.Vault library in the *** Settings *** section:

*** Settings ***
Library    RPA.Robocorp.Vault

We use the Get Secret keyword from the RPA.Robocorp.Vault library to fetch a secret by name credentials and store the secret to a variable. We can then access the properties of the secret by their name:

*** Tasks ***
Get and log the value of the vault secrets using the Get Secret keyword
    ${secret}=    Get Secret    credentials
    # Note: in real robots, you should not print secrets to the log. this is just for demonstration purposes :)
    Log    ${secret}[username]
    Log    ${secret}[password]

Read the vault values - Option 2: Python library

In the file variables/variables.py, we import the RPA Framework vault library and read the values from the vault:

from RPA.Robocorp.Vault import Vault

_secret = Vault().get_secret("credentials")

USER_NAME = _secret["username"]
PASSWORD = _secret["password"]

Any variables in a variables file that don't start with an underscore are exposed to Robot Framework

After this, ${USER_NAME} and ${PASSWORD} variables can be accessed in the robot script, as we see here:

*** Tasks ***
Get and log the value of the vault secrets using the imported variables file
    # Note: in real robots, you should not print secrets to the log. this is just for demonstration purposes :)
    # This works because we are importing the `variables.py` file:
    Log    ${USER_NAME}
    Log    ${PASSWORD}

The RPA Framework vault library handles both local and Control Room vault. It looks for the RPA_SECRET_MANAGER environment variable and defaults to Control Room vault.

Control Room vault

Configure your vault in Control Room in the relevant workspace using the UI. The name of the secret should match the name used in your code that reads the secret, for example, credentials. Provide the secrets as key-value pairs.

Video instructions