HashiConf 2025 Don't miss the live stream of HashiConf Day 2 happening now View live stream
Vault Home

token create

The token create command creates a new token that can be used for authentication. Vault creates the new token as a child of the currently authenticated token. When Vault creates the child token in the same namespace as the currently authenticated token, the child token inherits all policies and permissions associated with the parent token unless you explicitly assign different policies with -policy.

When you create a child token in a different namespace, Vault does not automatically assign all policies and permissions from the parent token. Instead, Vault assigns explicitly requested policies for the target namespace and default when applicable.

A ttl can also be associated with the token. If a ttl is not associated with the token, then it cannot be renewed. If a ttl is associated with the token, it will expire after that amount of time unless it is renewed.

Metadata associated with the token (specified with -metadata) is written to the audit log when the token is used.

If a role is specified, the role may override parameters specified here.

Examples

Create a token attached to specific policies:

$ vault token create -policy=my-policy -policy=other-policy
Key                Value
---                -----
token              95eba8ed-f6fc-958a-f490-c7fd0eda5e9e
token_accessor     882d4a40-3796-d06e-c4f0-604e8503750b
token_duration     768h
token_renewable    true
token_policies     [default my-policy other-policy]

Create a periodic token:

$ vault token create -period=30m
Key                Value
---                -----
token              fdb90d58-af87-024f-fdcd-9f95039e353a
token_accessor     4cd9177c-034b-a004-c62d-54bc56c0e9bd
token_duration     30m
token_renewable    true
token_policies     [my-policy]

Usage

The following flags are available in addition to the standard set of flags included on all commands.

Output options

  • -field (string: "") - Print only the field with the given name. Specifying this option will take precedence over other formatting directives. The result will not have a trailing newline making it ideal for piping to other processes.

  • -format (string: "table") - Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the VAULT_FORMAT environment variable.

Command options

  • -display-name (string: "") - Name to associate with this token. This is a non-sensitive value that can be used to help identify created secrets (e.g. prefixes).

  • -entity-alias (string: "") - Name of the entity alias to associate with during token creation. Only works in combination with -role argument and used entity alias must be listed in allowed_entity_aliases. If this has been specified, the entity will not be inherited from the parent.

  • -explicit-max-ttl (duration: "") - Explicit maximum lifetime for the token, measured from token creation. This hard limit only applies to service tokens. Renewals do not reset or extend it. Uses duration format strings.

  • -id (string: "") - Value for the token. By default, this is an auto-generated value. Specifying this value requires sudo permissions.

  • -metadata (k=v: "") - Arbitrary key=value metadata to associate with the token. This metadata will show in the audit log when the token is used. This can be specified multiple times to add multiple pieces of metadata.

  • -no-default-policy (bool: false) - Detach the "default" policy from the policy set for this token.

  • -orphan (bool: false) - Create the token with no parent. This prevents the token from being revoked when the token which created it expires. Setting this value requires sudo permissions.

  • -period (duration: "") - Create a periodic token with this TTL. The TTL is reset to this period after each successful renewal. The token expires if it is not renewed before the current TTL ends, or when an -explicit-max-ttl limit is reached. Setting this value requires sudo permissions. Uses duration format strings.

  • -policy (string: "") - Name of a policy to associate with this token. This can be specified multiple times to attach multiple policies.

  • -renewable (bool: true) - Allow the token to be renewed up to it's maximum TTL.

  • -role (string: "") - Name of the role to create the token against. Specifying -role may override other arguments. The locally authenticated Vault token must have permission for auth/token/create/<role>.

  • -ttl (duration: "") - Initial TTL to request for the token. This does not set the token's maximum lifetime or the TTL used for periodic renewals. Renewals may extend the token's total lifetime beyond this value, subject to applicable maximum TTLs. Uses duration format strings.

  • -type (string: "service") - The type of token to create. Can be "service" or "batch".

  • -use-limit (int: 0) - Number of times this token can be used. After the last use, the token is automatically revoked. By default, tokens can be used an unlimited number of times until their expiration.

  • -wrap-ttl (duration: "") - Wraps the response in a cubbyhole token with the requested TTL. The response is available via the "vault unwrap" command. The TTL is specified as a numeric string with suffix like "30s" or "5m". This can also be specified via the VAULT_WRAP_TTL environment variable.

Edit this page on GitHub