# Vault | pass | helper

**URL:** <https://forum.ansible.com/t/vault-pass-helper/44642>\
**Category:** Get Help\
**Created:** [October 8, 2025, 4:21pm UTC](https://forum.ansible.com/t/vault-pass-helper/44642 "2025-10-08T16:21:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chumi](https://avatars.discourse-cdn.com/v4/letter/c/f08c70/32.png) [@chumi](https://forum.ansible.com/u/chumi)\
**Post date:** [October 8, 2025, 4:21pm UTC](https://forum.ansible.com/t/vault-pass-helper/44642/1 "2025-10-08T16:21:38Z")

</div>

Hi,

I am interested in the way ansible use the Helper pass to manage the vault password.  
My wish is to run a playbook without entering a vault password but instead, i prefer using my gpg key to unlock the **[pass](https://www.passwordstore.org/)** that manage the vault password.

- pass
- vault
- helper

My old method:

```auto
pass ansible/vault | head -1 | ansible-playbook --vault-password-file=/bin/cat -i inventories/template foo.yml

```

My new wanted method:  
Into .ansible.cfg file

```auto
[vault]
identity_list = ansible/vault@pass

```

Then run:

```auto
ansible-playbook -i inventories/template foo.yml

```

But when checking with ansible-config, i do not see the vault part. I wonder why…  
So when running the new method, it ask the password key file instead of requesting the gpg password that manage pass.

```auto
[WARNING]: Error getting vault password file (ansible/vault): The vault password file
my_directory/ansible/pass was not found

```

i have tried to create a bash file, /usr/local/bin/ansible-pass.sh

```auto
#/bin/bash
pass ansible/vault

```

and add .ansible.cfg

```auto
[vault]
identity_list = ansible/vault@/usr/local/bin/ansible-pass.sh

```

But is is not better.

Any idea would be appreciated for my problem.  
But also, i would like to know yours to manager the vault.

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [October 8, 2025, 4:27pm UTC](https://forum.ansible.com/t/vault-pass-helper/44642/2 "2025-10-08T16:27:53Z")

</div>

you ‘vault file’ can be a script, it just needs to be executable and output ‘the secret’ to be used. Note that ‘relative’ paths in ansible.cfg are relative to the config file itself, not your CWD.

---

<div class="post-metadata">

**Author:** ![chumi](https://avatars.discourse-cdn.com/v4/letter/c/f08c70/32.png) [@chumi](https://forum.ansible.com/u/chumi)\
**Post date:** [October 8, 2025, 4:38pm UTC](https://forum.ansible.com/t/vault-pass-helper/44642/3 "2025-10-08T16:38:55Z")

</div>

> DEFAULT\_VAULT\_IDENTITY\_LIST

should be used instead of

```auto
[vault]
identity_list = ansible/vault@pass

```

ansible-config list the config but the run ask a pass password file.  
So, i get the error.