---
title: Password Vault Support in the Kron PAM Desktop Client
slug: kronpam-end-user-guide-3-8-1/password-vault-support-in-the-kron-pam-desktop-client
docTags: 
createdAt: 2025-07-03T09:41:41.383Z
---

If the user has at least** SAPM Account Module Visibility**, **SAPM Group Module Visibility,** and “SAPM Management” portal privileges, the Vault tab of the Kron PAM Desktop Client appears for this user. If the user has only a “list only” account permission, the user cannot see the Vault tab.

If the user has sufficient portal privileges and permissions, the user can list both Vault Account Groups and Vault Accounts that are bound to these groups. Moreover, the user can search the Vault Accounts by using the filters.

Under the **Vault Account Groups**, there is at least one Vault Account, and each Vault Account is represented by a line that contains:

- **Vault Account Name** (e.g., Static SSL), 
- **Vault Configuration **(e.g., Static SSL Certificate), 
- **Details button **
- **Approval Status **(e.g., Need approval, waiting, no need approval, etc),
- **Connect to Target Device button **(this button works as a target device button, similar to Web GUI)
- Colorful **Check out button **(might be Check outPassword, Check outSSH Key, etc, depending on the Vault Configuration). Moreover, depending on the Approval Status, its color is changed.
- Lastly, the **Reset Password button **if the Vault Configuration is **Account With Device (Dynamic Type).**

For the details of the Password Vault, please refer to the Password Vault Section in the[Reference Guide](docId\:hGPjfiZi0v6YRoIO9Zqak). 

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/eIqDBb4sFagB8XWyhfw_s_image.png" size="34" width="431" height="843" position="center" caption="Password Vault on Kron PAM Desktop Client" showCaption="true"}

If there is no approval flow for the **static **vault account, the user clicks the **Check out **button to check out the passwords/SSH keys, etc, depending on the Vault Configuration.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/1qKAy6hmpBDKDF-3C8ASj_image.png" size="56" width="421" height="386" position="center" caption="Check out the password related to the Account with Device (Static Type) " showCaption="true"}

If there is no approval flow for the **dynamic **vault account, once the user clicks the **Check out **button, they should select the duration and write a comment before checking the password out.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/cQtcqrkHvjD5JDghqcBoC_image.png" size="48" width="394" height="487" position="center" caption="Setting duration and comment before checking the password out of the dynamic type" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/XwkNi9gD0yBI6JzCudUdX_image.png" size="48" width="405" height="413" position="center" caption="Check out the password related to the Account with Device (Dynamic Type)" showCaption="true"}

If there is an** approval flow for the dynamic or static vault account**, before checking the password out, the requestee should send an approval request. To do so, the user should click the **Check out** button. This time, it leads to another screen, and after the user enters duration and comments on this screen, the user should click the **Request Approval** button.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/CsPS-SSBi4Txp0sKF2jjm_image.png" size="50" width="449" height="555" position="center" caption="Requesting Approval before checking the password out" showCaption="true"}