Virtual Event
Join us for the next HashiConf Digital October 12-15, 2020 Register for Free

Getting Started

Your First Secret

If you successfully completed the steps in Starting the Server, you started the dev server and exported the VAULT_TOKEN to the initial root token value so that vault login is not required to authenticate. If you have not yet completed those steps, please review that guide and do so before proceeding here.

Now that the dev server is up and running, let's get straight to it and read and write your first secret.

One of the core features of Vault is the ability to read and write arbitrary secrets securely. Secrets written to Vault are encrypted and then written to backend storage. Therefore, the backend storage mechanism never sees the unencrypted value and doesn't have the means necessary to decrypt it without Vault.

NOTE: An interactive tutorial is also available to perform the steps described in this guide. Click the Show Tutorial button to launch the tutorial.

»Writing a Secret

Let's start by writing a secret. This is done very simply with the vault kv command, as shown below:

$ vault kv put secret/hello foo=world

Key              Value
---              -----
created_time     2019-02-04T19:53:22.730733Z
deletion_time    n/a
destroyed        false
version          1

This writes the pair foo=world to the path secret/hello. You'll learn paths in more detail later, but for now it is important that the path is prefixed with secret/, otherwise this example won't work. The secret/ prefix is where arbitrary secrets can be read and written.

You can even write multiple pieces of data.

$ vault kv put secret/hello foo=world excited=yes

Key              Value
---              -----
created_time     2019-02-04T19:54:03.250328Z
deletion_time    n/a
destroyed        false
version          2

The vault kv command interacts with K/V secrets engines. For more information, see the command documentation.

»Getting a Secret

As you might expect, secrets can be retrieved with vault kv get:

$ vault kv get secret/hello

====== Metadata ======
Key              Value
---              -----
created_time     2019-02-04T19:54:03.250328Z
deletion_time    n/a
destroyed        false
version          2

===== Data =====
Key        Value
---        -----
excited    yes
foo        world

Vault gets the data from storage and decrypts it. The output format is purposefully whitespace separated to make it easy to pipe into a tool like awk.

This contains some extra information. To print only the value of a given field, use the -field=<key_name> flag.

$ vault kv get -field=excited secret/hello

yes

Optional JSON output is very useful for scripts. For example, you can use the jq tool to extract the value of the excited secret.

$ vault kv get -format=json secret/hello | jq -r .data.data.excited

yes

»Deleting a Secret

Now that you've learned how to read and write a secret, let's go ahead and delete it. You can do so using the vault kv delete command.

$ vault kv delete secret/hello

Success! Data deleted (if it existed) at: secret/hello

»Next

In this guide, you learned how to use the powerful CRUD features of Vault to store arbitrary secrets. On its own, this is already a useful but basic feature.