In the previous guide, you started the dev server and exported the
VAULT_DEV_ROOT_TOKEN_ID to the initial root token value so that
vault login is not required to authenticate. If you have not yet completed those steps, please review that guide and do so before proceeding here.
Now that the dev server is up and running, let's get straight to it and read and write our first secret.
One of the core features of Vault is the ability to read and write arbitrary secrets securely. On this page, you'll do this using the CLI, but there is also a complete HTTP API that can be used to programmatically do anything with Vault.
Secrets written to Vault are encrypted and then written to backend storage. For our dev server, backend storage is in-memory, but in production this would more likely be on disk or in Consul. Vault encrypts the value before it is ever handed to the storage driver. The backend storage mechanism never sees the unencrypted value and doesn't have the means necessary to decrypt it without Vault.
NOTE: An interactive tutorial is also available to perform the steps described in this guide. Click the Show Tutorial button to launch the tutorial.
»Writing a Secret
Let's start by writing a secret. This is done very simply with the
vault kv command, as shown below:
vault kv put secret/hello foo=world Key Value --- ----- created_time 2019-02-04T19:53:22.730733Z deletion_time n/a destroyed false version 1
This writes the pair
foo=world to the path
cover paths in more detail later, but for now it is important that the
path is prefixed with
secret/, otherwise this example won't work. The
secret/ prefix is where arbitrary secrets can be read and written.
You can even write multiple pieces of data.
vault kv put secret/hello foo=world excited=yes Key Value --- ----- created_time 2019-02-04T19:54:03.250328Z deletion_time n/a destroyed false version 2
vault kv command interacts with K/V secrets engines. For more information,
see the command documentation.
Warning: The examples in this guide use the
<key>=<value> input to send
secrets to Vault. However, sending data as a part of the CLI command often end
up in the shell history unencrypted. To avoid this, refer to the documentation or
Static Secrets: Key/Value Secrets Engine
learn different approaches.
»Getting a Secret
As you might expect, secrets can be retrieved with
vault kv get:
vault kv get secret/hello ====== Metadata ====== Key Value --- ----- created_time 2019-02-04T19:54:03.250328Z deletion_time n/a destroyed false version 2 ===== Data ===== Key Value --- ----- excited yes foo world
Vault gets the data from storage and decrypts it. The output format is
purposefully whitespace separated to make it easy to pipe into a tool like
This contains some extra information. To print only the value of a given field,
vault kv get -field=excited secret/hello yes
Optional JSON output is very useful for scripts. For example, you can use the
jq tool to extract the value of the
vault kv get -format=json secret/hello | jq -r .data.data.excited yes
»Deleting a Secret
Now that you've learned how to read and write a secret, let's go ahead
and delete it. You can do so using the
vault kv delete command.
vault kv delete secret/hello Success! Data deleted (if it existed) at: secret/hello
In this guide, you learned how to use the powerful CRUD features of Vault to store arbitrary secrets. On its own, this is already a useful but basic feature.