1. What is the Credential Vault app? #
An introduction to the secrets vault built into the Dynatrace platform.
Secure, centralized storage #
In observability, hardcoding passwords in test scripts or agent configurations is a major security flaw. The Dynatrace Credential Vault app solves this problem by providing a centralized, highly secure place to store your secrets (passwords, API tokens, certificates). These secrets can then be referenced dynamically by the various components of the Dynatrace ecosystem without ever exposing their values in plain text to users.
2. Credential types #
Dynatrace can store several secret formats suited to different technical needs.
Username/password #
The most classic type, mainly used for Basic Auth authentication or to fill in login forms in Browser Monitors.
Token #
Stores access tokens or API keys. This format is especially used for service-to-service interactions or by extensions that query REST APIs.
Certificate #
Used to store SSL/TLS certificates or SSH private keys. It is essential for synthetic monitors checking endpoints secured by client certificates, or for extensions accessing servers over SSH.
Public certificate #
Stores public certificates (in PEM format). This type is used to establish an SSL/TLS chain of trust when connecting to services using certificates issued by internal or private certificate authorities.
3. Main use cases #
Where and how are the secrets stored in the Credential Vault used in Dynatrace?
Synthetic Monitoring #
This is one of the most frequent use cases. If you configure an automated test scenario (HTTP Monitor or Browser Monitor) that requires authentication (Basic Auth, login form, etc.), you must use the Credential Vault. At run time, the robot invisibly retrieves the credentials to simulate the login.
👉 To learn more about creating these scenarios, read our detailed article: Dynatrace Synthetic Monitoring: complete guide (article 51).
Extensions 2.0 (collection authentication) #
When you deploy a Dynatrace Extension to monitor a specific technology (such as an Oracle/SQL Server database, SNMP network devices or third-party APIs), the ActiveGate needs credentials to connect to these targets. The Credential Vault securely distributes this information to the extension, directly at the monitoring point.
AppEngine (custom apps) #
With the Dynatrace AppEngine framework, you can build custom applications that run directly on the platform. If your app needs to communicate with an external API (for example to open a Jira ticket or query ServiceNow), AppEngine relies on the Credential Vault to inject the required API tokens on the backend, so developers don't have to embed secrets in the app's source code.
Summary table of scopes #
The table below summarizes the scopes available when creating a credential:
| Scope | Use | Credential |
|---|---|---|
| Synthetic | Synthetic monitors (Browser and HTTP). | Username/password, Token, Certificate |
| Extension | Dynatrace extensions (Extensions 2.0). | Username/password, Public certificate |
| AppEngine | Custom applications built on AppEngine. | Username/password, Token, Certificate, Public certificate |
| Monitoring | System settings that require credentials (VMware, Kubernetes, etc.). | Username/password, Token |
4. Integration with external vault solutions #
Seamless integration with existing enterprise vaults.
Synchronization (single source of truth) #
Companies often already have their own secrets management system. Dynatrace does not force you to duplicate these credentials and risk them getting out of sync. The Credential Vault integrates natively with the major solutions on the market:
- Azure Key Vault: cloud-native integration to retrieve secrets stored in your Microsoft Azure environment.
- HashiCorp Vault: support for HashiCorp secrets engines, the de facto standard in DevOps and Kubernetes environments.
- CyberArk Vault: integration with one of the leading privileged access management (PAM) solutions for environments that require very high security.
With these integrations, Dynatrace queries these platforms in real time or synchronizes with them. So when a security policy forces the monthly rotation of a business password in CyberArk, Dynatrace transparently picks up the new value immediately.
5. Managing access to the credentials you create #
Granular control over who can see and handle your credentials.
Separation of privileges and scopes #
Storing a secret is essential, but controlling its use is just as important. Dynatrace applies strict rules to the Credential Vault:
- Usage rights vs read rights: a user (or group) can be allowed to use a credential (to attach it to a synthetic monitor, for example) without ever being allowed to read its value or password in plain text.
- Scopes: when creating a credential, you define its scope. For example, you can configure a secret so that it can be used only by Extensions, blocking it for Synthetic Monitoring. This prevents misuse of sensitive service accounts.
- RBAC and audit: combined with Dynatrace's role-based access control (RBAC), every interaction (creation, modification, use) with a credential is recorded in the platform's audit logs.
