diff --git a/src/Services/Ordering/Ordering.API/Ordering.API.csproj b/src/Services/Ordering/Ordering.API/Ordering.API.csproj
index 8576e3cc8..11b2d13f9 100644
--- a/src/Services/Ordering/Ordering.API/Ordering.API.csproj
+++ b/src/Services/Ordering/Ordering.API/Ordering.API.csproj
@@ -37,6 +37,7 @@
     <PackageReference Include="Microsoft.ApplicationInsights.DependencyCollector" Version="2.6.1" />
     <PackageReference Include="Microsoft.ApplicationInsights.Kubernetes" Version="1.0.0-beta8" />
     <PackageReference Include="Microsoft.ApplicationInsights.ServiceFabric" Version="2.1.1-beta1" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.AzureKeyVault" Version="2.1.0" />
     <PackageReference Include="Microsoft.Extensions.Logging.AzureAppServices" Version="2.1.0" />
     <PackageReference Include="Microsoft.AspNetCore.App" Version="2.1.0" />
     <PackageReference Include="MediatR" Version="4.1.0" />
diff --git a/src/Services/Ordering/Ordering.API/Program.cs b/src/Services/Ordering/Ordering.API/Program.cs
index 011f3004f..50fa8b98b 100644
--- a/src/Services/Ordering/Ordering.API/Program.cs
+++ b/src/Services/Ordering/Ordering.API/Program.cs
@@ -7,6 +7,7 @@ using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using System;
 using System.IO;
 
 namespace Microsoft.eShopOnContainers.Services.Ordering.API
@@ -38,7 +39,22 @@ namespace Microsoft.eShopOnContainers.Services.Ordering.API
                 .ConfigureAppConfiguration((builderContext, config) =>
                 {
                     config.AddJsonFile("settings.json");
-                    config.AddEnvironmentVariables();
+
+                    var builtConfig = config.Build();
+
+                    var configurationBuilder = new ConfigurationBuilder();
+
+                    if (Convert.ToBoolean(builtConfig["UseVault"]))
+                    {
+                        configurationBuilder.AddAzureKeyVault(
+                            $"https://{builtConfig["Vault:Name"]}.vault.azure.net/",
+                            builtConfig["Vault:ClientId"],
+                            builtConfig["Vault:ClientSecret"]);
+                    }
+
+                    configurationBuilder.AddEnvironmentVariables();
+
+                    config.AddConfiguration(configurationBuilder.Build());
                 })
                 .ConfigureLogging((hostingContext, builder) =>
                 {
diff --git a/src/Services/Ordering/Ordering.API/settings.json b/src/Services/Ordering/Ordering.API/settings.json
index ef9b9e03c..96dd74630 100644
--- a/src/Services/Ordering/Ordering.API/settings.json
+++ b/src/Services/Ordering/Ordering.API/settings.json
@@ -17,5 +17,11 @@
     "InstrumentationKey": ""
   },
   "EventBusRetryCount": 5,
-  "EventBusConnection": "localhost"
+  "EventBusConnection": "localhost",
+  "UseVault": false,
+  "Vault": {
+    "Name": "eshop",
+    "ClientId": "your-clien-id",
+    "ClientSecret": "your-client-secret"
+  }
 }