![Set up BYOK with HashiCorp Vault](https://pachca.com/help/hashicorp-art.jpg)

# Set up BYOK with HashiCorp Vault

> How to set up BYOK with HashiCorp Vault in the Pachca team chat app. A step-by-step guide with examples

Источник: https://pachca.com/en/help-center/administration/instrukciya-po-nastroyke-byok-s-hashicorp-vault

1.  Open the HashiCorp Vault admin console

2.  Go to **Secret Engines**

![Secret Engines](https://pachca.com/secret-engines.jpg)

3.  If Transit isn't enabled yet, click **Enable new engine** and select **Transit**

![Transit](https://pachca.com/transit.jpg)

4.  Click **Create Key** to add a new root key. Pachca will use it to derive temporary encryption keys

![Create Key](https://pachca.com/create-key-vault.jpg)

5.  Name the key and leave Auto-rotation off. Copy the key name

6.  In Pachca, open **Workspace settings** → **Advanced encryption**

![Advanced encryption](https://pachca.com/pachca-plus-vault.jpg)

7.  In the **KMS Key ID** field, enter the name of the key you created

8.  In the **JSON key** field, enter this code:

```json
{
  "token": "Token with permission to use the Transit API",
  "address": "Vault URL (http://localhost:8200)"
}
```

9.  Make sure the token has the required permissions (policy) for the Transit API:

```hcl
path "transit/keys" {
  capabilities = ["list"]
}
path "transit/keys/pachca" {
  capabilities = ["read"]
}
path "transit/encrypt/pachca" {
  capabilities = ["update"]
}
path "transit/decrypt/pachca" {
  capabilities = ["update"]
}
path "transit/datakey/plaintext/pachca" {
  capabilities = ["update"]
}
```

If your key has a different name, replace `pachca` with it.

> **Important:** Only the **Owner** can open **Advanced encryption** in workspace settings.

Updated: December 3, 2025