---
title: Credential management
slug: docs/credential-management
docTags: 
createdAt: 2024-04-18T15:08:32.944Z
---

There are three ways to provide the required credentials to TruffleHog:

1. Config flag with a URI to a secret manager (recommended)
2. Config flag with a file
3. Environment variables

## Config with URI to a secret manager

You can provide URIs to the scanner to indicate that it should retrieve the local configuration from different sources.

For example,

:::BlockQuote
$ trufflehog scan --config="gsm://my-gcp-project/secret-name"...
:::

### AWS Secrets Manager

AWS Secrets Manager secrets are expected to contain the Plaintext yaml config file, and are specified with this schema to the --config flag:

:::BlockQuote
asm://REGION/SECRET\_NAME
:::

Check out the [AWS Secret Manager documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_secret.html) for more information on using that product.

### GCP Secrets Manager

Google Secrets Manager secrets are expected to contain the yaml config file, and are specified with this schema to the --config flag:

:::BlockQuote
gsm://GCP\_PROJECT\_NAME/SECRET\_NAME
:::

Check out the [GCP Secret Manager documentation](https://cloud.google.com/secret-manager/docs) for more information on using that product.

### Azure Key Vault

Azure Key Vault secrets are expected to contain the YAML config file, and are specified with this schema to the `--config` flag:

:::BlockQuote
akv://AZURE\_VAULT\_NAME/SECRET\_NAME
:::

Check out the [Azure Key Vault documentation](https://learn.microsoft.com/en-us/azure/key-vault/) for more information on using that product.

## Config flag with a file

You can specify your configuration directly in a file. Environment variables in the form `$VARIABLE` and `${VARIABLE}` found in the file will be expanded at runtime if they are set. References to unset variables will not be replaced.

```shell
$ trufflehog scan --config="/path/to/config.yaml"
```

## Environment variables

Using environment variables can provide the bare-minimum configuration so that TruffleHog can connect to the API. If you’d like to use environment variables within a config file, see the above `Config flag with a file` section

```shell
TRUFFLEHOG_API_ADDRESS=real-big-chipmunk.api.c1.prod.trufflehog.org:8443
TRUFFLEHOG_SCANNER_GROUP=Some scanner group
TRUFFLEHOG_SCANNER_TOKEN=thog-agent-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

```