Postman Vault Secrets

Passwords, tokens, and API keys deserve more care than ordinary variables. Postman Vault is a secure local storage area for such sensitive values. Think of a bank safe-deposit box: only you hold the key, and nobody else can open the box, even if they share your workspace.

Why Ordinary Variables Fall Short

Regular variables sit in plain view. A teammate may spot a secret in an exported file. A screenshot may expose a token. Initial values can sync to the cloud by accident. Vault solves these risks by keeping secrets on your device in encrypted form.

  REGULAR VARIABLE                     VAULT SECRET
  ─────────────────                    ─────────────
  Visible in the variable table        Hidden behind a lock
  May sync with the workspace          Stays on your device
  Appears in exported files            Never appears in exports
  Anyone with access can read it       Only you can unlock it

Set Up Vault

1. Open the Vault icon in the bottom-right area of the Postman window.
2. Click Create vault key the first time.
3. Copy the generated vault key and store it in a password manager.
4. Click Unlock to open the vault.

The vault key decrypts your secrets. A lost key cannot be recovered, so keep a safe backup.

Add a Secret

1. Click Add new secret in the vault panel.
2. Type a name, such as shopApiKey.
3. Paste the secret value.
4. Limit the secret to allowed domains, for example api.example.com.
5. Click Save.

Domain Restrictions

Each vault secret can bind to specific hosts. Postman then fills the secret only into requests that target those hosts. A mistyped URL pointing at an unknown server never receives your key.

  Secret: shopApiKey   Allowed: api.example.com

  Request to api.example.com   ──► secret inserted   ✅
  Request to other-site.com    ──► secret stays empty ❌

Use a Secret in a Request

Reference a vault secret with the vault prefix inside double curly braces.

GET https://api.example.com/orders
X-API-Key: {{vault:shopApiKey}}

Postman replaces the placeholder at send time. The collection file itself stores only the placeholder text, which carries no sensitive information.

Secrets in Scripts

Scripts read vault values through the vault methods of the pm object.

const key = await pm.vault.get("shopApiKey");
pm.request.headers.add({ key: "X-API-Key", value: key });

Check the current Postman documentation for the exact script permissions your version requires, because vault access in scripts follows security settings.

Vault Compared with Other Options

Option	Best For	Limitation
Initial value	Safe, shareable constants	Syncs to the cloud
Current value	Personal tokens during testing	Visible in the local variable table
Vault secret	Long-lived keys and passwords	Stays local, so each teammate adds their own
External secret manager	Company-wide secret storage	Needs a supported integration

Daily Security Checklist

• Move every long-lived key from variables into the vault.
• Rotate secrets on a regular schedule.
• Lock the vault when you leave your computer.
• Remove secrets from screenshots and recordings before sharing them.
• Report a leaked secret to the owner immediately so they can revoke it.

Key Points

• Vault stores sensitive values encrypted on your own device.
• A vault key unlocks the secrets and needs a safe backup.
• Domain restrictions stop keys from reaching the wrong server.
• The vault prefix inserts secrets into requests without exposing them in files.
• Each teammate keeps a personal vault, so secrets never travel through shared workspaces.