docs(vault): document separate login and secret namespaces

[devin-ai-integration]

Summary

Documents the two new HashiCorp Vault settings that split the Vault Enterprise namespace used for AppRole and TLS cert login (HCP_VAULT_LOGIN_NAMESPACE, sent as the X-Vault-Namespace header) from the namespace used for secret reads, writes, rotates and deletes (HCP_VAULT_SECRET_NAMESPACE, a URL path segment). Both fall back to HCP_VAULT_NAMESPACE, so the page keeps the single-variable example as the default and adds a "Namespaces" section with a worked example for the customer's shape: a role defined in a parent namespace that logs in there and manages keys and provider secrets under a team namespace. The per-team namespace override bullet now says it replaces the secret namespace in the URL and never affects login, which matches what the code does after the companion litellm change. The env var reference table in docs/proxy/config_settings.md gains a row for each new variable, next to the existing HCP_VAULT_* rows, which is also what the litellm repo's documentation and code-quality checks read to confirm every os.getenv key is documented

Companion code change: BerriAI/litellm branch litellm_vault_login_secret_namespace (LIT-1983)

Proof

npm run build exits 0 and the rendered page shows the new section

Linear ticket

Resolves LIT-1983

Link to Devin session: https://app.devin.ai/sessions/798e6e6460fc40deb35c1219944662cf
Open in Devin Desktop: https://app.devin.ai/desktop/session/798e6e6460fc40deb35c1219944662cf?variant=devin
Requested by: @yassin-berriai

---

Note

Low Risk
Documentation-only updates with no runtime or security behavior changes in this repository.

Overview
Documents split Vault Enterprise namespaces for HashiCorp Vault: optional HCP_VAULT_LOGIN_NAMESPACE (AppRole/TLS login via X-Vault-Namespace) and HCP_VAULT_SECRET_NAMESPACE (secret URL path segment), both defaulting to HCP_VAULT_NAMESPACE so existing setups stay valid.

The Step 1 env example and a new Namespaces section explain when to use each setting, including a parent-namespace login + team secret path example and Admin UI field names. The team JSON override for namespace is updated to describe secret URL namespace only (not login).

^{Reviewed by Cursor Bugbot for commit bf206a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
litellm	Ready	Preview	Sep 17, 2026 2:53am UTC

[mateo-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bf206a5. Configure here.}