# Rasa Pro License

You'll need a license to get started with Rasa Pro. [Get it here](/content/rasa-pro-developer-edition-license-key-request/index.html).

## Available in Rasa Pro from 3.5.0

Rasa Pro supports the following secrets managers:

- [HashiCorp Vault](https://www.hashicorp.com/products/vault)

Currently, Rasa Pro supports safeguarding credentials for the following services:

- [Tracker Stores](https://legacy-docs-oss.rasa.com/docs/rasa/next/tracker-stores)

## HashiCorp Vault Secrets Manager
Use Vault Secrets Manager to store credentials used to authenticate access to external services. The credentials are stored in a Vault instance and can be encrypted at rest. To store credentials in a Vault instance, you can read the official Vault docs [Storing secrets in Vault](https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-first-secret).

You can also encrypt credentials at rest with [Vault Transit Engine](https://www.vaultproject.io/docs/secrets/transit).

### Authentication

Rasa Pro can authenticate to Vault through [Token authentication](https://www.vaultproject.io/docs/auth/token).

Both `expiring` and `non-expiring` (so-called, root tokens) tokens are supported. Rasa Pro will automatically renew the token if it is expiring.

### How to configure access to Vault

Access to Vault secrets manager can be configured with environment variables and through `endpoints.yml` configuration file.

Environment variables and `endpoints.yml` configuration file are merged together and **the values from the environment variables take precedence**.

### New in 3.7

Vault namespaces can be used to isolate secrets. You can configure a namespace with the `VAULT_NAMESPACE` environment variable or the `namespace` key in the secrets_manager section of the `endpoints.yml` file. To learn more about namespaces, check out the [Vault namespaces docs](https://developer.hashicorp.com/vault/docs/enterprise/namespaces).

The following environment variables are available:

| Environment Variable | Description | Default |
| :-- | :-- | :-- |
| `SECRET_MANAGER` | **Required**. The secrets manager to use. _Currently only "vault" is supported_ | `vault` |
| `VAULT_HOST` | **Required**. The address of the vault server |  |
| `VAULT_TOKEN` | **Required**. token to authenticate to the vault server |  |
| `VAULT_RASA_SECRETS_PATH` | Path to the secrets in the vault server | `rasa-secrets` |
| `VAULT_TRANSIT_MOUNT_POINT` | If transit secrets engine is enabled, set this to mount point of the transit engine |  |
| `VAULT_NAMESPACE` | If namespaces are used, set this to the path of the namespace |  |

To configure the Vault secrets manager, you can fill the following section in `endpoints.yml` file:

```yaml
secrets_manager:
  type: vault  # required - the secrets manager to use
  token: <token>  # required - token to authenticate to the vault server
  url: "http://localhost:1234"  # required - the address of the vault server
  secrets_path: rasa-secrets  # path to the secrets in the vault server if not set it defaults to `rasa-secrets`
  transit_mount_point: transit  # if transit secrets engine is enabled, set this to mount point of the transit engine
  namespace: my-namespace  # if namespaces are used, set this to the path of the namespace
```

### Store access credentials in environment variables

A simple example on how to combine environment variables and `endpoints.yml` configuration file would be to store access token in the environment variable and the rest of the configuration in the `endpoints.yml` file.

```bash
# environment variables
VAULT_TOKEN=<token used to authenticate to Vault>
```

```yaml
secrets_manager:
  type: vault
  url: "http://localhost:1234"
  secrets_path: rasa-secrets  # if not set it defaults to `rasa-secrets`
  transit_mount_point: transit  # if you have enabled transit secrets engine, and you want to use it
  namespace: my-namespace  # if namespaces are used, set this to the path of the namespace
```

### How to configure Tracker Store with Vault Secrets Manager

1. Configure Rasa to access the Vault instance

Checkout the [How to configure access to Vault](https://legacy-docs-oss.rasa.com/docs/rasa/next/secrets-managers/#how-to-configure-access-to-vault) section for more details.

2. Configure Rasa to use the Vault secrets manager to fetch credentials for the tracker store:

```yaml
tracker_store:
  type: SQL
  url: localhost:5432
  username:
    source: secrets_manager.vault
    secret_key: sql_store_username
  password:
    source: secrets_manager.vault
    secret_key: sql_store_password
```