> This page is for Itential Platform On-Prem, version 6 (default).
> For other versions, use one of these documentation indexes:
> - 6 (default): https://docs-test.itntl.com/itential-platform/6/llms.txt
> - 2023.2: https://docs-test.itntl.com/itential-platform/2023-2/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs-test.itntl.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs-test.itntl.com/_mcp/server.

# Use CyberArk secrets

> Reference secrets from CyberArk CCP in Platform configurations

Reference and use secrets from CyberArk CCP in Itential Platform configuration values and in Application, Adapter, and Integration properties.

> **Info**
>
> Itential Platform has read-only access to CyberArk CCP. You cannot write secrets to CyberArk Digital Vault from Itential Platform.

## Secret reference format

Use this format to reference CyberArk secrets:

```
$SAFE_<SafeName> $NAME_<SecretName>
```

The format includes:

* `$SAFE_` followed by the CyberArk Safe name
* A space character
* `$NAME_` followed by the secret name

**Example:** `$SAFE_My-Safe $NAME_mongodb` retrieves the "mongodb" secret from the "My-Safe" safe.

## Configure Itential Platform

> **Warning**
>
> You cannot use CyberArk secret references to configure the Itential Platform connection to CyberArk CCP.

### Properties files

Add CyberArk references to system properties through platform properties or environment variables. See [Platform Properties and Environment Variables](/itential-platform/configure/environment-variables-properties-reference) for details.

**`Platform 6 (platform.properties)`**

```properties title="Platform 6 (platform.properties)"
mongo_auth_enabled=true
mongo_user=$SAFE_DavyJonesLocker $NAME_mongodb-user
mongo_password=$SAFE_DavyJonesLocker $NAME_mongodb-password
mongo_db_name=itential-platform-6
mongo_url=$SAFE_DavyJonesLocker $NAME_mongouri
```

**`Itential Platform 2023.2 (properties.json)`**

```json title="Itential Platform 2023.2 (properties.json)"
{
  "mongoProps": {
    "credentials": {
      "dbAuth": true,
      "user": "$SAFE_DavyJonesLocker $NAME_mongodb-user",
      "passwd": "$SAFE_DavyJonesLocker $NAME_mongodb-password"
    },
    "db": "itential-platform-23-2",
    "url": "$SAFE_DavyJonesLocker $NAME_mongouri"
  }
}
```

### Environment variables

Platform 6 only. Set environment-specific secrets using CyberArk references:

```bash
export ITENTIAL_MONGO_AUTH_ENABLED="true"
export ITENTIAL_MONGO_USER="$SAFE_DavyJonesLocker $NAME_mongodb-user"
export ITENTIAL_MONGO_PASSWORD="$SAFE_DavyJonesLocker $NAME_mongodb-password"
export ITENTIAL_MONGO_DB_NAME="itential-platform"
export ITENTIAL_MONGO_URL="$SAFE_DavyJonesLocker $NAME_mongouri"
```

### System profiles

#### Open Admin Essentials

Navigate to **Admin Essentials** and select **Profiles**.

#### Select the active profile

Select the active profile from the list.

#### Open configuration

Click the **Configure** tab.

#### Select property

Select a profile property to encrypt.

![Edit Profile properties](/_fern-img/c3e38df005c09f7921a379daf008249f9e190ee494a59437143b6c0ec8df8298.webp)

#### Add CyberArk reference

Replace the value with a CyberArk reference.

#### Save and restart

Save the configuration and restart Itential Platform.

## Configure applications, adapters, and integrations

The following example uses an Adapter instance. The same steps apply to Applications and Integrations.

### Using configuration form

#### Open Admin Essentials

Navigate to **Admin Essentials** and select **Adapters**.

#### Select adapter

Select your adapter from the list.

#### Replace sensitive values

Replace sensitive values in the property configuration form with CyberArk references.

#### Save configuration

Click **Save**. The adapter restarts automatically and retrieves the secret.

![Adapter connection status](/_fern-img/00a50e92476eed4abb338e832803a7254f1a6eef72d3a844d58269f894418e40.webp)

### Using advanced view

#### Open Admin Essentials

Navigate to **Admin Essentials** and select **Adapters**.

#### Select adapter

Select your adapter from the list.

#### Enable advanced view

Click the **Advanced View** toggle in the upper-right to access the JSON configuration.

#### Replace sensitive values

Replace sensitive values with CyberArk references.

#### Save configuration

Click **Save**. The adapter restarts automatically and retrieves the secret.

## Next steps

#### [Configure](/itential-platform/secrets/cyberark/set-up)

Review configuration

#### [Troubleshoot](/itential-platform/secrets/cyberark/monitor-troubleshoot)

Resolve common issues