---
title: Secret managers
description: If you have a third-party secret management system (secret manager), you can configure instances of the PingFederate secret manager plugin, and use the instances to generate reference codes for your secret manager's contents.
component: pingfederate
version: 12.3
page_id: pingfederate:administrators_reference_guide:pf_secret_managers
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_secret_managers.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: May 29, 2026
superseded_by: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_secret_managers.html
---

# Secret managers

If you have a third-party secret management system (secret manager), you can configure instances of the PingFederate secret manager plugin, and use the instances to generate reference codes for your secret manager's contents.

PingFederate supports secret managers for the following services:

* [LDAP connections](help_datasourcetasklet_ldapconfigstate.html)

* [REST API datastores](pf_config_rest_api_datastore.html)

In the secret manager, you can store the passwords and other credentials that PingFederate needs to access supported services. If you have a secret manager, you can integrate it with PingFederate and then configure one or more instances of the secret manager plugin. After using an instance to generate a reference code for a specific datastore credential in the secret manager, you can add the reference code to a PingFederate datastore plugin instance, allowing PingFederate to get the credential from your secret manager.

Storing datastore credentials in a secret manager is not only secure, it also lets you change the credentials in the secret manager without needing to change the configuration of the datastore plugins because the credential reference codes do not change. This is particularly useful when you rotate credentials.

You can [integrate PingFederate with the CyberArk Credential Provider](integra_cyberark_credenti_provider.html)out-of-the-box. If you have a different secret manager, you can use the SecretManager interface in the [PingFederate SDK](../sdk_developers_guide/pf_sdk_developers_guide.html) to build a custom solution that connects PingFederate to your secret manager.