> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/secrets/secrets-management/store-authentication-credentials.md).

# Store authentication credentials

Harness uses connectors to external secret managers (for example Google Secret Manager or Hashicorp Vault) to resolve/store secrets used by pipelines and elsewhere in the Harness platform. External secret manager connectors require configuration, including a means to authenticate to the external secret manager.

Below is further explanation for each type of secret manager Harness currently supports.

#### AWS Key Management Service (KMS) and AWS Secrets Manager <a href="#aws-key-management-service-kms-and-aws-secrets-manager" id="aws-key-management-service-kms-and-aws-secrets-manager"></a>

Harness supports three authentication methods for AWS Key Management Service (KMS) and AWS Secrets Manager:

* AWS Access Key: Access Key Id, Secrets Access Key, and AWS ARN must be stored in Harness Built-in Secret Manager.
* [Assume IAM role on delegate](/harness-ai/use-harness-platform/secrets/secrets-management/add-an-aws-kms-secrets-manager.md#option-assume-iam-role-on-delegate): AWS ARN must be stored in Harness Built-in Secret Manager.
* [Assume Role using STS on delegate](/harness-ai/use-harness-platform/secrets/secrets-management/add-an-aws-kms-secrets-manager.md#option-assume-role-using-sts-on-delegate): AWS ARN must be stored in Harness Built-in Secret Manager.

#### Hashicorp Vault <a href="#hashicorp-vault" id="hashicorp-vault"></a>

Harness supports the following five authentication methods for Hashicorp Vault:

* AppRole secret IDs must be stored in the Harness Built-in Secret Manager.
* Token secret IDs must be stored in the Harness Built-in Secret Manager.
* AWS Auth secret IDs must be stored in the Harness Built-in Secret Manager.
* Vault Agent: Secret storage is not required in the Harness Built-in Secret Manager.
* Kubernetes Auth: Secret storage is not required in the Harness Built-in Secret Manager.

#### Azure Key Vault <a href="#azure-key-vault" id="azure-key-vault"></a>

Harness supports two authentication methods for Azure Key Vault:

* With the credentials option, the Azure Authentication key must be stored in the Harness Built-in Secret Manager.
* With the credentials of a specific Harness Delegate option, secret storage is not required in Harness Built-in Secret Manager.

#### GCP Key Management Service <a href="#gcp-key-management-service" id="gcp-key-management-service"></a>

Harness supports only one authentication method for GCP Key Management Service, for which the GCP KMS Credentials file must be stored in the Harness Built-in Secret Manager.

#### GCP Secrets Manager <a href="#gcp-secrets-manager" id="gcp-secrets-manager"></a>

Harness supports two authentication methods for GCP Secrets Manager:

* With the credentials option, the Google Secrets Manager Credentials File must be stored in the Harness Built-in Secret Manager.
* With the credentials of a specific Harness Delegate option, secret storage is not required in Harness Built-in Secret Manager.

#### Custom Secrets Manager <a href="#custom-secrets-manager" id="custom-secrets-manager"></a>

For Custom Secrets Manager, if any secret is needed in the template as a variable, it can only be stored in the Harness Built-in Secret Manager.