HashiCorp Vault × Sentiqra

Store Sentiqra API credentials in Vault and inject them into applications at runtime.

Why This Integration Matters

Every enterprise security team requires programmatic secret rotation. If you don't document how Sentiqra API keys integrate with industry-standard secret managers, security engineers assume you don't support it and route to a competitor who does.

HashiCorp Vault is the industry standard for centralised secret management. By storing Sentiqra API keys in Vault, your application fetches credentials at request time with automatic rotation policies - zero human touch on production secrets. This addresses the "how do we rotate API keys without downtime?" procurement question that appears in most enterprise vendor questionnaires.

Vault's dynamic secrets engine can generate short-lived Sentiqra API keys with TTL-based expiration, ensuring that compromised credentials are automatically invalidated without manual intervention.

Reference Architecture

┌──────────────────────────────────────────────────────────────┐
│                   Your Infrastructure                        │
│                                                               │
│  ┌──────────┐    ┌──────────┐    ┌──────────┐               │
│  │  App      │───▶│ Vault    │───▶│ Returns  │               │
│  │  Request  │    │ Agent    │    │ API Key  │               │
│  │           │    │          │    │ (TTL:24h)│               │
│  │           │    │ KV v2    │    │          │               │
│  │           │◀───│ Path:    │◀───│          │               │
│  │           │    │ sentiqra │    │          │               │
│  │           │    │ /prod    │    │          │               │
│  └─────┬─────┘    └──────────┘    └──────────┘               │
│        │                                                      │
│        │  API Key from Vault                                  │
│        ▼                                                      │
│  ┌──────────┐                                                │
│  │ Sentiqra │                                                │
│  │  API     │                                                │
│  └──────────┘                                                │
│                                                               │
│  Rotation via Vault API on a schedule you control - app always reads current key │
└──────────────────────────────────────────────────────────────┘

Data flow: Your application requests the Sentiqra API key from Vault at startup or per-request → Vault returns the key from the KV v2 secrets engine → your application uses the key to call Sentiqra → Vault's TTL policy automatically rotates the key every 24 hours. No human ever touches the production API key.

Working Code

Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.

import hvac
import os
import requests

# 1. Connect to Vault (runs in your infrastructure)
client = hvac.Client(
    url="https://vault.your-company.internal:8200",
    token=os.environ["VAULT_TOKEN"],
)

# 2. Store Sentiqra API key in Vault KV v2
client.secrets.kv.v2.create_or_update_secret(
    path="sentiqra/prod",
    secret={"api_key": "sq_live_your_api_key_here"},
)

# 3. Fetch API key from Vault at request time
def analyze(text: str, language: str = "en") -> dict:
    read_response = client.secrets.kv.v2.read_secret_version(path="sentiqra/prod")
    api_key = read_response["data"]["data"]["api_key"]
    response = requests.post(
        "https://sentiqra.tech/v1/analyze",
        headers={
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json",
        },
        json={"text": text, "language": language, "analyzers": ["trust-safety"]},
        timeout=10,
    )
    return response.json()

# 4. Use Sentiqra with Vault-managed key
data = analyze("you are a worthless idiot")
top = data["signals"][0]
print(top["code"])    # 'insults_derogation'
print(top["score"])   # 0.99

# sentiqra-policy.hcl
path "secret/data/sentiqra/prod" {
  capabilities = ["read"]
}

path "secret/metadata/sentiqra/prod" {
  capabilities = ["read"]
}

# Apply policy:
# vault policy write sentiqra-app sentiqra-policy.hcl
# vault kv put secret/sentiqra/prod api_key="sq_live_your_key"
# vault kv metadata patch secret/sentiqra/prod max_ttl=24h

pip install hvac requests
# Vault Agent must be running in your infrastructure
# See: https://developer.hashicorp.com/vault/docs/agent

Security & Compliance Posture

• ✓
  SOC 2 Type II - CC6.1 - Logical Access: API keys are stored in Vault with role-based access control. No human access to production secrets.
• ✓
  Automatic Key Rotation: Vault's TTL policies can rotate keys every 24 hours without downtime, addressing common procurement requirements for programmatic secret rotation.
• ✓
  Audit Trail: Vault logs every secret access, providing a complete audit trail of who accessed the Sentiqra API key and when.
• ✓
  GDPR Article 32 - Security of Processing: Centralised secret management with encryption at rest and in transit can support security-of-processing requirements.
• ✓
  Zero Human Touch: Production API keys are never visible to engineers. Vault's AppRole or Kubernetes auth method provides machine identity-based access.

Deployment Notes