# Permit vaulted passwords in extra variables via Tower

**URL:** <https://forum.ansible.com/t/permit-vaulted-passwords-in-extra-variables-via-tower/32434>\
**Category:** AWX Project\
**Created:** [March 10, 2020, 5:46pm UTC](https://forum.ansible.com/t/permit-vaulted-passwords-in-extra-variables-via-tower/32434 "2020-03-10T17:46:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Spiro\_Mitsialis](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Spiro\_Mitsialis](https://forum.ansible.com/u/Spiro_Mitsialis)\
**Post date:** [March 10, 2020, 5:46pm UTC](https://forum.ansible.com/t/permit-vaulted-passwords-in-extra-variables-via-tower/32434/1 "2020-03-10T17:46:27Z")

</div>

I’m using Tower 3.6.2 with Ansible 2.9.2.  
I have a “credential” with a vault password and have it associated with a template. I’m trying to add a vaulted variable as an extra variable at either the inventory or template. I use the following to create:

`echo -n 'password' | ansible-vault encrypt_string --stdin-name 'variable_name'`

`which gives:`

> `cmdb_client_secret: !vault |`  
> `$ANSIBLE_VAULT;1.1;AES256`  
> `65313832653034653135666634623466313430336361326261396230633031396431373561623036`  
> `61323136633637333035383536333561306`

TOWER EXTRA VARIABLE:

{  
“cmdb\_client\_secret”: {  
“\_\_ansible\_vault”: “!vault | $ANSIBLE\_VAULT;1.1;AES256 663835616563613939386664626537356238623762383365393…”  
}  
}

I’ve tried adding it as json in tower and it accepts it but its not decrypted. I see uses the exact string instead. I’ve tried with and without the \_\_ansible\_vault (as per above). It works if I enter it into the playbook but this is problematic as I have dev, QA and prod environment with different url/username/pw.

How do I enter it so that its decrypted.

---

<div class="post-metadata">

**Author:** ![Jake\_McDermott](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@Jake\_McDermott](https://forum.ansible.com/u/Jake_McDermott)\
**Post date:** [March 11, 2020, 1:13pm UTC](https://forum.ansible.com/t/permit-vaulted-passwords-in-extra-variables-via-tower/32434/2 "2020-03-11T13:13:36Z")

</div>

There is a vault credential type in Tower. You should:

- create a vault credential using the vault password needed to decrypt the secret you’re using in the playbook / vars.
- assign that vault credential to the job template(s) you use to run the playbook