---
title: Environment variable vault
description: Use environment variables on the Kong Gateway data plane to
  store and reference secrets.
url: "/gateway/entities/vault/environment-variable/"
canonical_url: "/gateway/entities/vault/environment-variable/"
content_type: reference
products:
- Kong Gateway
tools:
- Admin API
- Konnect API
- deck
- KIC
- Terraform
tags:
- secrets-management
canonical: true
works_on:
- on-prem
- konnect


---

# Environment variable vault










The environment variable vault is built into Kong Gateway and doesn't require any external services.
You can store secrets as environment variables on the data plane and reference them in any field that supports Vault references.

You can set up an environment variable vault in one of the following ways:

* Using the [Vault entity](/gateway/entities/vault/)
* Using [environment variables](/gateway/entities/vault/#store-secrets-as-environment-variables), set at Kong Gateway startup
* Using parameters in [`kong.conf`](/gateway/configuration/), set at Kong Gateway startup

The Vault entity can only be used once the database is initialized. 
Secrets for values that are used before the database is initialized can’t make use of the Vaults entity.

## Create an environment variable vault

The following example creates an `env` Vault entity:





### decK

  

```yaml
_format_version: "3.0"
vaults:
  - name: env
    prefix: env-vault
    description: Storing secrets in environment variables
    config:
      prefix: example-prefix
```
{: data-file="kong.yaml" data-tool="deck" }





### Admin API

  

```bash
curl -i -X POST http://localhost:8001/vaults/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "env",
      "prefix": "env-vault",
      "description": "Storing secrets in environment variables",
      "config": {
        "prefix": "example-prefix"
      }
    }
    '
```




### Konnect API

  

To create a Vault entity, call the Konnect [control plane config API's `/vaults` endpoint](/api/konnect/control-planes-config/#/operations/create-vault).  


```bash
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "env",
      "prefix": "env-vault",
      "description": "Storing secrets in environment variables",
      "config": {
        "prefix": "example-prefix"
      }
    }
    '
```





### KIC

  

```yaml
echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: env-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: env
  prefix: env-vault
  description: Storing secrets in environment variables
  config:
    prefix: example-prefix
" | kubectl apply -f -
```






### Terraform

  


```hcl
resource "konnect_gateway_vault" "my_vault" {
  prefix = "env-vault"
  description = "Storing secrets in environment variables"
  config = {
    prefix = "example-prefix"
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}
```











## Vault configuration options


### Environment Variable Prefix
Parameter format: |
  * **Vault entity:** `vaults.config.prefix`
  * **kong.conf parameter:** `vault_env_prefix`
  * **Environment variable:** `KONG_VAULT_ENV_PREFIX`
Description: The prefix for the environment variable that the value will be stored in.

### Base64 Decode <br>v3.11+
Parameter format: |
  * **Vault entity:** `vaults.config.base64_decode`
  * **kong.conf parameter:** `vault_env_decode_base64`
  * **Environment variable:** `KONG_VAULT_ENV_DECODE_BASE64`
Description: Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.






## Related Resources

- [Kong Gateway Vault entity](/gateway/entities/vault/)

- [Supported Kong Gateway Vault backends](/gateway/entities/vault/#supported-vault-backends)

- [Secrets management](/gateway/secrets-management/)