vault

Start the Vault server in development mode

$ vault server -dev

$ vault login [token]

$ vault kv put secret/[path] [key]=[value]

$ vault kv get secret/[path]

$ vault kv list secret/

$ vault kv delete secret/[path]

$ vault secrets enable -path=[path] [engine]

$ vault status

vault [globaloptions] command [commandoptions] [arguments]

Vault by HashiCorp is a secrets management tool that securely stores and controls access to tokens, passwords, certificates, API keys, and other secrets. It provides encryption as a service, dynamic secrets generation, and detailed audit logging.
The CLI is a wrapper around the HTTP API and supports interactive and scripted use. Configuration can be set via environment variables: VAULT_ADDR for the server address and VAULT_TOKEN for authentication.
Vault uses a seal/unseal mechanism for security. After initialization, Vault is sealed and requires unseal keys to become operational. In dev mode (vault server -dev), Vault starts unsealed for testing.

login

Authenticate to Vault and obtain a token.

Write secrets to the key-value secrets engine.

Read secrets from the key-value secrets engine.

Delete secrets from the key-value secrets engine.

List secret keys at a path.

Enable a secrets engine at a path.

Disable a secrets engine.

Enable an authentication method.

Initialize a new Vault cluster.

Unseal the Vault.

Seal the Vault.

Print the current status of Vault.

Start a Vault server.

Show help for a specific API path.

Address of the Vault server.

Vault token for authentication.

Output format: table, json, yaml.

Display help for a command.

The dev server stores data in memory and is not for production use. Unsealing requires a threshold of key shares; losing too many shares can make the Vault unrecoverable. Token management is critical for security; leaked tokens should be immediately revoked.

Vault was created by HashiCorp and first released in April 2015. It was designed to address the challenge of managing secrets in modern infrastructure. Key features like dynamic secrets, leasing, and renewal were core from the beginning. Vault has grown to support numerous authentication methods and secrets engines, becoming a standard tool for secrets management in DevOps and cloud-native environments.

consul(1), terraform(1), gpg(1), pass(1)