# Utilizing a HTTP Vault in Body **URL:** \ **Category:** Get Help\ **Tags:** custom-database-connections, connections\ **Created:** [January 18, 2025, 8:58pm UTC](https://community.auth0.com/t/utilizing-a-http-vault-in-body/169194 "2025-01-18T20:58:46Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sam.karl](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sam.karl/32/60022_2.png) [@sam.karl](https://community.auth0.com/u/sam.karl)\ **Post date:** [January 18, 2025, 8:58pm UTC](https://community.auth0.com/t/utilizing-a-http-vault-in-body/169194/1 "2025-01-18T20:58:46Z")
Since there is not integration for utilizing external email providers yet in flows. I have to do a http request first get a access token for my Microsoft email. However, I want to protect my secret key. Since the vault connection automatically attaches it as a bearer token it cannot be used. Is there a way to utilize the vault for the body of a http request? If I place my client secret plainly in the body can users see this request within the flow? Are there security concerns? ---
**Author:** ![sumansaurav](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sumansaurav/32/70627_2.png) [@sumansaurav](https://community.auth0.com/u/sumansaurav)\ **Post date:** [January 19, 2025, 7:04am UTC](https://community.auth0.com/t/utilizing-a-http-vault-in-body/169194/2 "2025-01-19T07:04:01Z")
When making HTTP requests within Auth0 flows that require secrets (like Microsoft OAuth client secrets), here are the key points to consider: 1. Regarding secret visibility: - Users with access to the Auth0 dashboard can see the HTTP request configuration in flows, including any hardcoded secrets in the body - The actual request logs/traces don’t show the full request body by default, but it’s still not ideal to have secrets in plain text 1. Current limitations: - You’re correct that the Vault integration automatically uses secrets as Bearer tokens - There isn’t a direct way to use Vault secrets in the request body through the UI configuration My recommendations would be: 1. Store the client secret in Auth0’s Secret Vault 2. Access it programmatically in your **custom action code** rather than the visual flow builder 3. Use environment variables for non-secret configuration values 4. Consider implementing a caching mechanism for the Microsoft token to reduce the number of times you need to use the secret If you absolutely must use the visual flow builder: - Consider setting up a secure middleware/proxy service that handles the Microsoft OAuth flow - The flow would then only need to call your secure endpoint without exposing secrets Adding a diagram to explain my recommendation: ![Screenshot 2025-01-19 at 2.03.18 AM](https://global.discourse-cdn.com/auth0/original/3X/5/e/5e3d2e7c879dcd32c4b33f7ea0f866814c83cd13.png) Hope this helps! ---
**Author:** ![sam.karl](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sam.karl/32/60022_2.png) [@sam.karl](https://community.auth0.com/u/sam.karl)\ **Post date:** [January 19, 2025, 7:02pm UTC](https://community.auth0.com/t/utilizing-a-http-vault-in-body/169194/3 "2025-01-19T19:02:35Z")
Thanks Suman, I little more background of why I am using two HTTP requests in my forms flow is that I am doing a OTP for new users only. I like your idea of creating the bearer token in the actions using the secrets. I could then pass this token down to the forms flow where I create the OTP and send it via the MS graph API. I could possibly do a management API to modify the the vault bearer token from actions which may work as well. I’ll have to look into this, but right now since this is a one time action for new users, it’s working well enough. My feature request at this time would be to have Management API to send a OTP email using a template. Then I could just create the code in flows or actions and then send it using the API and then collect and verify all while using my configured email provider. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 11, 2025, 7:31pm UTC](https://community.auth0.com/t/utilizing-a-http-vault-in-body/169194/4 "2025-03-11T19:31:45Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed. ---
**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\ **Post date:** [December 31, 2025, 3:23pm UTC](https://community.auth0.com/t/utilizing-a-http-vault-in-body/169194/6 "2025-12-31T15:23:52Z")
Hi There! We are excited to announce the availability of the **Flows Auth0 Send Email Action**! This new feature streamlines how you communicate with users by allowing you to send emails directly from Flows using the Email Provider already configured in your Auth0 Tenant. ### Key Highlights - **Unified Configuration:** Say goodbye to redundant setups. You can now leverage your existing Tenant Email Provider settings directly within Flows without extra configuration effort. - **Enhanced Flexibility:** We have included support for **Custom Email Providers** , giving you full control over your email delivery infrastructure. - **Dynamic Customization:** The action supports a variety of settings, including custom variables and **Liquid Syntax** , allowing for highly personalized email templates. ### Resources Ready to streamline your email logic? Check out the documentation below to learn more: - [Flows Auth0 Send Email Documentation](https://auth0.com/docs/customize/forms/flows/integrations/auth0#send-email) We’d love to hear how you plan to use this in your workflows. Thanks! Dawid