In SDK versions of 2.164.0 and newer, this is automatically pulled from vault properly for multitenant extensions. So now you can just do self.hq_credentials.aba

First, we add a new vendor config to the extension:

# extension.py
VENDOR_CONFIGS = {
    'aba': 'AUTO_POPULATED'
}

Next, we need to set the value. While the ABA isn't populated at runtime, it is populated at install time. This allows us to automatically populate it using a VendorConfig step of the DBPlan so it doesn't have to be manually populated. (This is why we defaulted the value to AUTO_POPULATED; we don't want to cause confusion at install time)

# db_plan.py
from q2_sdk.core.configuration import settings
from q2_sdk.core.install_steps import db_plan
from q2_sdk.core.install_steps.vendor_config import ConfigDataType

# [...]

self.vendor_config = [
    db_plan.VendorConfig(
        vendor_name='your_sso_name',
        config_name='aba',
        config_value=settings.HQ_CREDENTIALS.aba,
        data_type=ConfigDataType.String
    )
]

We can now access the ABA in our extension code like any other vendor config:

# extension.py
async def default(self):
    return Q2SSOResponse(
        ResponseType.HTML,
        response=f'Configured ABA: {self.vendor_configs["aba"]}'
	)