When triggering webhooks or direct orchestrator calls from Port Self-Service Actions or Workflows, Port currently requires secrets (API keys, tokens) to be stored within Port itself. For organizations with strict infosec policies — where all secrets must reside exclusively in HashiCorp Vault — this is a blocker.

The workaround today is to route through a CI system (GitHub Actions, Jenkins, etc.) that handles the Vault key exchange, but this introduces an unwanted dependency for teams using a direct orchestrator pattern where the orchestrator feeds execution feedback back into Port.

Requested Capability:

Native support for HashiCorp Vault as a secrets backend for Port Actions/Workflows — allowing Port to resolve secrets at runtime from Vault rather than storing them locally.

Use Case:

Customer: Sophos (via Nuno Pinto)

Trigger: Self-Service Action → direct webhook/orchestrator call requiring authenticated API keys

Constraint: Infosec policy mandates all secrets stored in HashiCorp Vault only

Current gap: No native Vault secrets resolution; CI workaround not viable for their direct-trigger architecture