What is the Liquibase HashiCorp Vault extension?

Last updated: July 14, 2025

You can natively read your application secrets in Liquibase with the Hashicorp Vault extension. If you connect to your vault using the liquibase.properties file, you can store sensitive Liquibase authentication details such as database url, username, and password attributes and your Liquibase Pro license key in your vault.

For more information, see HashiCorp Vault documentation.

Token authentication

Tip: Token authentication is the recommended way to connect Liquibase to HashiCorp Vault.

Vault usage without namespace using token authentication:

# Enable Liquibase Pro functionality liquibase.licenseKey= hashicorp,secret/data/liquibase/license,pro_key # Properties to store in the vault url= hashicorp,secret/data/liquibase/urlLocation,url username= hashicorp,secret/data/liquibase/usernameLocation,username password= hashicorp,secret/data/liquibase/passwordLocation,password # Authentication vault.addr= https://vault.example.com:8200 vault.token= -DvaultTokenExample

JSON web token (JWT) authentication

Tip: If you need to use JWT authentication, please email support@liquibase.com for configuration assistance.

Vault usage with namespace using JWT authentication:

Note: liquibase.licenseKey= OR liquibase.licenseKey: are valid ways to indicate the values in the liquibase.properties file.

# Properties to store in the vault liquibase.licenseKey= hashicorp,secret/data/liquibase/license,pro_key url= hashicorp,secret/data/liquibase/urlLocation,url username= hashicorp,secret/data/liquibase/usernameLocation,username password= hashicorp,secret/data/liquibase/passwordLocation,password # Authentication vault.addr=https://vault.example.com:8200 vault.jwt=your-jwt-token vault.namespace=your-vault-namespace vault.role=your-vault-role

Command Line Attributes

Attribute	Definition	Requirement
`--license-key`	Your Liquibase Pro license key	Required
`--vault-addr`	URL for HashiCorp Vault Server	Required
`--vault-token`	Access Token for HashiCorp Vault Server	Optional
`--vault-namespace`	Namespace for HashiCorp Vault Requests	Optional