---
title: "Stores"
slug: "stores"
status: "update"
updated: 2025-11-16T17:33:29Z
published: 2025-11-16T17:33:29Z
canonical: "docs.plainid.io/stores"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Stores

## Configuring a Secret Store

The **Secret Store** retrieves relevant Secrets—such as private keys, tokens, or database credentials—for use at Runtime. The Secrets Management Service supports various store integrations, allowing multiple Secret Stores to be defined in a single configuration. This flexibility enables you to source Secrets from different providers based on their intended use or target environment.

Each configured store must include a unique `id`, which is later referenced when defining how and where a Secret is used. You can define one store as the default, or specify the store explicitly for each Secret.

Refer to the individual Secret Store pages for store-specific parameters and examples based on the following parameters:

- [Hashicorp](/v1/docs/hashicorp)
- [AWS Secret Manager](/v1/docs/aws-secret-manager)
- [AWS RDS IAM Authentication](/v1/docs/aws-rds-iam-authentication)
- [Azure Key Vault](/v1/docs/azure-key-vault)
- [CyberArk CCP](/v1/docs/cyberark-ccp)

---

### General Store Parameters

The following example shows how to define one or more Secret Stores in your configuration. Each store is defined under the top-level `secretStore` section.

```
secretStore:
  - id: vault
    type: Vault
    isDefault: true
    details:
      defaultPath: vault_
      skipVerify: true
      url: vault
      timeout: 3s
      enginePath: custom
      pathPrefix: prefix
    auth:  # Authentication can be via Token or Kubernetes
      method: Token  # Token, Kubernetes
      tokenValue: token
#    tokenFileName: ${ VAULT_TOKEN }  # Optional alternative to tokenValue
#
#  auth:
#    method: Kubernetes
#    path: /var/path-to-file/file.txt
#    role: secrets-mgmt
```

---

### Parameter Reference

The table below describes the common parameters used when configuring a Secret Store. Store-specific parameters are defined under the `details` object and vary by store type.

| Parameter | Value | Description |
| --- | --- | --- |
| `id` | `vault` | A unique identifier for the Secret Store. This ID is used when referencing the store in other configuration blocks. |
| `type` | `Vault` | The type of Secret Store. Supported types include: - `Vault` - `AWSRDSIAMAuth` - `AWSSecretsManager` - `AzureKeyVault` - `Environment` - `File` |
| `isDefault` | `true` | Indicates whether this store should be used as the default. If multiple Secret Stores are configured, the default is used when a store is not explicitly specified. If no store is marked as default—or if more than one is—then the first listed store is used as the default. |
| `Decoder` | `none` | Optional. The decoder to use when retrieving the Secret value. Supported values are: - `Base64` - `None` |
| `details` | — | A section containing additional store-specific parameters. These vary depending on the selected `type` and are documented on the individual store pages. |
| `details.defaultPath` | `vault_` | Optional. The default path to use when accessing Secrets in the store. This can be used as a prefix or fallback location. |

---