Accessing Credential Vault Secrets Securely from Workflow TypeScript Code

[MarwanC]

Accessing Credential Vault Secrets Securely from Workflow TypeScript Code

Hello Dynatrace Community Colleagues,

I am currently implementing a workflow that needs to manage and rotate authentication tokens using the Dynatrace Credential Vault. Storing and rotating the token itself is not a problem, as I can leverage the Credential Vault APIs (ClientVault API / native Dynatrace credential management capabilities) to create, update, and rotate secrets.

The challenge is related to secure secret consumption within a custom Workflow task implemented in TypeScript.

Current Situation

My workflow needs to call external AWS APIs. To authenticate these calls, I need access to a token that is stored in the Dynatrace Credential Vault.

I want to avoid the following approaches:

• Hardcoding the token in the workflow definition.
• Storing the token in local variables.
• Exposing the secret in workflow inputs, outputs, logs, or task parameters.
• Persisting the token anywhere outside the Dynatrace Credential Vault.

What I Am Trying to Achieve

The built-in Workflow HTTP Task appears to be able to reference credentials stored in the Credential Vault and transparently inject them into outbound HTTP requests without exposing the underlying secret value.

My question is:

Is there an equivalent mechanism available for custom TypeScript code running in Workflows like the current HTTP Task of a workflow?

More specifically:

1. How does the Workflow HTTP Task securely retrieve credentials from the Credential Vault?
2. Which internal Dynatrace service or API is used for secret resolution?
3. Can custom workflow code access secrets through the same mechanism without exposing the secret material?
4. Is there a supported SDK, API, or execution context that allows a workflow application to consume vault-managed credentials securely?

Technical Context

From what I understand, credentials are managed through the Dynatrace Credential Vault and can be referenced by resources internally. However, the retrieval path used by native workflow tasks does not seem to be publicly documented for custom applications.

For example, when configuring an HTTP Task:

• A credential object is selected.
• The task executes successfully.
• The secret value is never exposed in the workflow definition or execution details which is indeed as intended by a credential vault design and principle.

This suggests that Dynatrace performs secure server-side secret resolution and injection.

I would like to understand whether custom TypeScript workflow code can leverage the same capability.

Alternative Recommendations

If direct access is intentionally restricted, I would appreciate guidance on recommended architectural patterns, such as:

• Using OAuth credentials managed by Dynatrace.
• Delegating AWS calls through a Workflow HTTP Task.
• Using service-to-service authentication mechanisms.
• Any supported secret-broker or credential-injection pattern for Workflow applications.

The Dynatrace Credential Vault and its APIs are powerful for secret lifecycle management, but currently they appear primarily geared toward Dynatrace-managed integrations. I am looking for a secure and supported way for custom workflow applications to consume those secrets without exposing them.

Any guidance, best practices, or product recommendations would be greatly appreciated.

Thank you.

[p_devulapalli]

@MarwanC Have you considered using credentialvaultclient ?

https://developer.dynatrace.com/develop/sdks/client-classic-environment-v2/#credentialvaultclient

[sujit_k_singh]

Hello @MarwanC 

Yes, credentialVaultClient from the @dynatrace-sdk/client-classic-environment-v2 package is exactly the mechanism you're looking for.

To answer your specific questions:

Points 1/2 — HTTP Task credential resolution: Correct. The HTTP Task resolves credentials server-side through the Credential Vault service. The secret value never appears in the workflow definition, execution history, or logs — only the credential ID is stored in the task configuration.

Points 3/4 — Custom TypeScript access: Correct. The "Run JavaScript" (ad-hoc action) task in a Workflow runs in an authenticated app context and can call credentialVaultClient directly from @dynatrace-sdk/client-classic-environment-v2.

Thanks,

Sujit

[MarwanC]

You may have miss read what I am really looking for, in the API there is no way to extract the token itself, the main usage in my workflow is to read the token from the vault and use it in a code to call another http call all by code, i.e. I need the actual token. I do not see any API that do this, please point me to the exact field that I can fetch the token value from. Here is the simplest code fragment that I can provide and it works fine from my task like but no token to use given the ID:

import { credentialVaultClient } from "@dynatrace-sdk/client-classic-environment-v2";

import { execution } from '@dynatrace-sdk/automation-utils';

// According to documentation
// The credentials set including username/certificate, password or token is included in the response.

const response = await credentialVaultClient.getCredentials
(
  {
    id: "CREDENTIALS_VAULT-DE4276F37CF26CCC"
  }
);

console.log(response.credentialUsageSummary);
console.log(response.description);
console.log(response.externalVault);
console.log(response.id);
console.log(response.name);
console.log(response.owner);
console.log(response.ownerAccessOnly);
console.log(response.scope);
console.log(response.type);

[sujit_k_singh]

Hi @MarwanC 

You're right, I should have been clearer. This is by design the Credential Vault never returns raw secrets through the API.

Unfortunately, there is no field that returns the actual token value. The getCredentials() response only contains metadata (name, type, scope, owner, etc.) no token or secret field exists.

This is a hard security boundary, Dynatrace intentionally never exposes raw secrets through the SDK in workflow code.

The only way to use vault credentials is through the built-in HTTP Request task, which resolves the secret server-side at execution time. The pattern is:

JavaScript task → prepare your request logic/body
HTTP Request task → make the authenticated call using Credential Vault (secret injected server-side, never exposed)
There's no workaround to extract the raw token in TypeScript — it's by design.

Thanks,

Sujit

[MarwanC]

Indeed the API is not usable via your own code, only if we call an API direct inside an HTTP task. This will ne be enough as we need to do a complex API calls, I also tried an app function but the method that used to exist also removed

export async function getVaultToken(credentialId: string) {

  // Add you test ID here

  //let credentialId = 'CREDENTIALS_VAULT-39E8BDA0E5B29E55';

  // You need also a scope to use this

  // Select the AppEngine scope to permit built-in apps from the latest Dynatrace to access a credential.

  try {

    // Extract Token from Vault        

    const credential = await credentialVaultClient.getCredentialWithSecrets({ id: credentialId });

    const token = credential.name;  // here we need .token but is not in the API here but it is in there when is used in the Workflow strange

    const message1 = `${credentialId} - Id was succeffully used.`;

    return { token: token };

  } catch (error: unknown) {

    let errorDetails = "";

    if (error instanceof Error) {

      errorDetails = `Error name: ${error.name}\n` +

                     `Error message: ${error.message}\n` +

                     (error.stack ? `Stack trace: ${error.stack}` : "No stack trace available.");

    } else {

      errorDetails = `Unknown error object: ${JSON.stringify(error, null, 2)}`;

    }  

    const message = `${credentialId} - Token was not successfully fetched.`;

    return { message };

  }

}

I have also an open ticket with Dynatrace but so far no one is able to provide an answer if this is possible

[sujit_k_singh]

Hi @MarwanC 

Thanks for sharing your findings.

From what you've shown, it appears that getCredentialWithSecrets() is either no longer available or no longer exposes the underlying secret material, and neither getCredentials() nor the current SDK APIs return the token value itself.

The fact that the HTTP Request task can use the credential while custom code cannot access the secret suggests that Dynatrace is performing credential resolution and injection within a privileged internal service rather than exposing the raw secret to Workflow/AppEngine code.

I understand the HTTP task chaining approach won't work for your use case given the complexity of your API calls. Unfortunately, I haven't found any currently documented SDK/API that allows a Workflow JavaScript task or App Function to retrieve the actual vault token value.

Based on the behavior you've observed, your support ticket is probably the best path to get a definitive answer from Engineering on whether this limitation is intentional or if there's a supported alternative for advanced custom-code scenarios. 

If you receive an update from Dynatrace Support, please share it here it would be very useful for others facing similar requirements.

Thanks,

Sujit

[MarwanC]

console.log(response.token);    ---- Always returns undefined

[sonja · Accepted solution]

Hi all, thanks for the great discussion here!

We've updated the documentation to make it clearer how to access credentials and make HTTP requests from the Run JavaScript action: https://docs.dynatrace.com/docs/analyze-explore-automate/workflows/default-workflow-actions/run-java...

Sonja

[sujit_k_singh]

Hi @sonja 

Thank you so much, things are much clear now.

Thanks,

Sujit

[MarwanC]

We have also developed our own API to sit on the top of your Client which makes it easier, as the documentation lacks n the area of updating the vault entry. I will share with the community.

[AurelienGravier]

I agree with previous comments, I recommend using sdk and credentialVaultClient.getCredentialsDetails method :
https://developer.dynatrace.com/develop/guides/security/manage-secrets/

I use it like this :

import { credentialVaultClient } from "@dynatrace-sdk/client-classic-environment-v2";

const VAULT_ID = "CREDENTIALS_VAULT-XXXXXXXXXXXXX";

export default async function ({ executionId }) {
const ex = await execution(executionId);
const creds = await credentialVaultClient.getCredentialsDetails({ id: VAULT_ID });

const headers = {
'accept': 'application/json; charset=utf-8',
'Authorization': `Api-Token ${creds.token}`,
'Content-Type': 'application/json; charset=utf-8'};

Regards, Aurelien