HCP Vault Secrets’ announced end-of-life date has passed. IBM’s official notice specifies the earlier of a customer’s Flex contract expiry or July 1, 2026, and says HCP Vault Secrets applications will be deleted.
This article was originally published before the deadline. Do not rely on its earlier export timeline as a current recovery procedure. If you need help with an old account, use the support contact in the official notice.
What replacement does HashiCorp recommend?
The notice points to HCP Vault Dedicated and Vault Community edition. It says the team is focusing on bringing ease-of-use improvements from HCP Vault Secrets to HCP Vault Dedicated. There is no need to infer a different business rationale.
A hosted replacement and a self-managed Vault cluster have different operational responsibilities. Evaluate authentication, backup and recovery, policy management, integrations, and maintenance before selecting one.
What other options should I evaluate?
Cloud-provider secrets services can fit workloads already using that provider’s identity and deployment system. Developer-oriented products can fit local workflows. Neither category should be ruled out solely by a general claim about MCP availability.
For example, 1Password Environments MCP now documents an integration that works with environment and variable names without returning stored secret values. For broader comparisons, use the current sourced comparison.
When is OpaqueVault relevant?
OpaqueVault focuses on encrypted storage and local AI-assisted command execution. Secret data is encrypted client-side, and the remote API does not receive its decryption keys.
Through MCP, vault_run injects selected credentials into a child process and returns an exit code and run metadata. Subprocess output is omitted from the MCP response. Hosted sync integrations, dynamic secret engines, and enterprise policy systems have separate requirements; assess those before treating OpaqueVault as a replacement.
How should I plan the move?
- Inventory the credentials, applications, identities, and integrations that need replacement.
- Establish which credentials remain available from an authorized backup or their issuing provider. Do not assume the retired service can still export them.
- Reissue or rotate credentials where necessary, then store them through the replacement’s trusted workflow.
- Recreate app and environment boundaries and test access with appropriately scoped identities.
- Update deployments and local tooling, verify the new paths, and remove obsolete credentials and configuration.
For OpaqueVault, start with the quickstart and agent documentation. Confirm the authentication and runtime requirements for CI before replacing an existing integration.
Updated October 23, 2026: changed the expired deadline framing, corrected the official EOL terms and rationale, and removed obsolete export and competitor guidance.