What is the Liquibase HashiCorp Vault extension?
Last updated: July 14, 2025
You can natively read your application secrets in Liquibase with the Hashicorp Vault extension. If you connect to your vault using the liquibase.properties file, you can store sensitive Liquibase authentication details such as database url, username, and password attributes and your Liquibase Pro license key in your vault.
For more information, see HashiCorp Vault documentation.
Token authentication
Tip: Token authentication is the recommended way to connect Liquibase to HashiCorp Vault.
Vault usage without namespace using token authentication:
# Enable Liquibase Pro functionality
liquibase.licenseKey= hashicorp,secret/data/liquibase/license,pro_key
# Properties to store in the vault
url= hashicorp,secret/data/liquibase/urlLocation,url
username= hashicorp,secret/data/liquibase/usernameLocation,username
password= hashicorp,secret/data/liquibase/passwordLocation,password
# Authentication
vault.addr= https://vault.example.com:8200
vault.token= -DvaultTokenExample
JSON web token (JWT) authentication
Tip: If you need to use JWT authentication, please email support@liquibase.com for configuration assistance.
Vault usage with namespace using JWT authentication:
Note: liquibase.licenseKey= OR liquibase.licenseKey: are valid ways to indicate the values in the liquibase.properties file.
# Properties to store in the vault
liquibase.licenseKey= hashicorp,secret/data/liquibase/license,pro_key
url= hashicorp,secret/data/liquibase/urlLocation,url
username= hashicorp,secret/data/liquibase/usernameLocation,username
password= hashicorp,secret/data/liquibase/passwordLocation,password
# Authentication
vault.addr=https://vault.example.com:8200
vault.jwt=your-jwt-token
vault.namespace=your-vault-namespace
vault.role=your-vault-role
Command Line Attributes
Attribute | Definition | Requirement |
| Your Liquibase Pro license key | Required |
| URL for HashiCorp Vault Server | Required |
| Access Token for HashiCorp Vault Server | Optional |
| Namespace for HashiCorp Vault Requests | Optional |