Response wrapping handoff vault
Pass a secret as a single-use wrapping token; note: any reuse trips a security alarm
T=$(vault kv get -wrap-ttl=60s -field=wrapping_token -mount=secret app); vault unwrap $T
more vault
all 31 commands →
Check token path capabilities
vault token capabilities database/creds/readonly
Revoke a dynamic lease
vault lease revoke -prefix database/creds/readonly
Login with token
vault login <token>
Login with AppRole
vault write auth/approle/login role_id=<role> secret_id=<secret>
KV get secret
vault kv get -mount=secret path/to/secret