Secrets & Key Management · Integration
Bitwarden
Add Bitwarden to your product for your customers, and give your AI agents governed access to it.
Bitwarden exposes two distinct machine interfaces: the organisation Public API at api.bitwarden.com/public covering members, groups, collections, policies and event logs, and Secrets Manager with its own projects, secrets and machine accounts. Both authenticate through OAuth 2.0 client credentials against identity.bitwarden.com/connect/token using an organisation client id and secret, and the resulting bearer token is short-lived, so long-running jobs must refresh mid-run. Region matters: customers on the EU cloud must call api.bitwarden.eu and identity.bitwarden.eu, and pointing at the US hosts returns an authentication failure that looks like bad credentials rather than a wrong region. The critical constraint is that vault item contents are end-to-end encrypted and the Public API never returns them, so it manages who can access what rather than reading passwords, and any integration promising to read vault entries is misunderstanding the product. Secrets Manager is the interface that does return secret values, and those are scoped to a machine account with explicit project access. fastn holds each customer's client credentials, handles token refresh and region routing, and keeps the connection maintained.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Let a customer connect their own Bitwarden organisation so your app can provision members and groups as staff join and leave
Sync collection membership from your own role model so access follows your app's permissions
Read organisation event logs into your audit view so vault activity sits alongside your own records
Fetch a Secrets Manager secret at runtime for a customer-configured integration instead of storing the value yourself
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
Ask an agent which members of a tenant's organisation have not enabled two-step login
Have an agent remove a leaver from all groups and collections, with the change audited per tenant
Let an agent report which machine accounts can read a given Secrets Manager project
Example prompt
Who in our Bitwarden organisation still has access to the Finance collection?
Set up Bitwarden in 4 steps
- 01Enable the Bitwarden connector from your fastn dashboard.
- 02Have each customer authorise their own Bitwarden account, so calls run under their credentials rather than a shared key.
- 03Decide which secrets, keys and certificates your product needs, map those fields, then enable the actions and triggers you want.
- 04Call it from your product and expose it to your agents through the same governed connection.
Why teams use the Bitwarden integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a Bitwarden integration without building it. Your customers connect their own Bitwarden account inside your product and work their secrets, keys and certificates there, with no per-customer code on your side.
- Handle the part that actually costs time: an expired certificate or an unrotated key is an outage rather than a warning, and it arrives without notice. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a Bitwarden update is not your on-call problem.
- One integration serves your product and your agents. The same governed Bitwarden connection powers in-product features and gives AI agents scoped, audited access, so you fetch a credential at the point of use instead of storing it yourself without wiring it twice.
Used by these teams
Compare with
AWS Secrets Manager
AppViewXOften used alongside
Tools the same teams tend to run next to Bitwarden, across other categories.
ServiceNow
Datadog
PagerDutyBitwarden integration FAQ
How do I add a Bitwarden integration to my product?
Enable the Bitwarden connector in your fastn dashboard, then let each customer authenticate their own Bitwarden account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no Bitwarden client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own Bitwarden account?
Yes. Every connection is scoped to the individual customer, so each authorises their own Bitwarden account and only ever sees their own secrets, keys and certificates. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this Bitwarden integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. Ask an agent which members of a tenant's organisation have not enabled two-step login
Who maintains the Bitwarden integration?
fastn does. When Bitwarden changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
Does my product ever hold the customer's Bitwarden secret?
No longer than the call needs it. Values are fetched under the customer's own credentials at the point of use and never written into your database, and every read is logged per tenant so an access can be traced to what asked for it.
Can rotation and expiry be handled automatically?
Yes, within the permissions the customer grants, and audited. This matters more here than almost anywhere else: an expired certificate or an unrotated key takes something down rather than raising a warning first.
What can I build with the Bitwarden integration?
A common starting point: let a customer connect their own Bitwarden organisation so your app can provision members and groups as staff join and leave. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the Bitwarden integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding Bitwarden does not change your per-connector cost. You can start free with 3 connected accounts.
Add Bitwarden to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.