What is HashiCorp Vault?

HashiCorp Vault is an open-source tool for managing secrets securely. It provides a central repository for sensitive data such as API keys, database credentials and encryption keys, with access control policies, audit logging and integration with identity providers like LDAP, OAuth2 and SAML.

Vault is designed to be flexible and programmable, which makes it a reasonable default for infrastructure that needs dynamic secret management rather than credentials pasted into a config file.

What Vault gives you

• Secret management — automate the creation, rotation and deletion of secrets.
• Encryption as a service — encrypt data without applications handling keys directly.
• Dynamic secrets — generate database credentials or API keys on demand, with a lease.
• Multi-tenancy — isolated environments for separate teams or applications.
• Audit logging — a record of every access and operation.
• Policy-based access control — fine-grained permissions for users and groups.
• High availability — cluster deployment for production use.

Why it matters

The argument for Vault is the same argument as for a source of truth in a network: one authoritative place, queryable by machines, with an audit trail. Credentials scattered across playbooks, CI variables and engineers' laptops are the infrastructure equivalent of an inventory spreadsheet — they work until the moment you need to answer a question about them.

1. Centralised secret management — no silos across applications and teams.
2. Secure access control — only authorised users or services reach a given secret.
3. Dynamic secrets — no hardcoded credentials in code.
4. Audit logging — usage tracking that satisfies a compliance review.
5. Programmability — an API-first design that integrates with existing workflows.

Installing Vault

Linux (Debian / Ubuntu)

wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update && sudo apt install vault

macOS (Homebrew)

brew tap hashicorp/tap
brew install hashicorp/tap/vault

Docker

docker pull hashicorp/vault:latest
docker run --rm --cap-add=IPC_LOCK -p 8200:8200 -e VAULT_DEV_ROOT_TOKEN_ID=dev-only-token hashicorp/vault:latest

Running a development server

Once installed locally, start a dev-mode instance. It runs in memory, unsealed, and prints a root token on startup — useful for experimenting, never for production.

vault server -dev

This starts Vault on http://localhost:8200.

Creating and reading a secret from Python

Vault's API-first design means most integration happens over HTTP. The example below writes a secret to the default KV v2 mount and reads it back.

import json
import requests

VAULT_ADDR = "http://localhost:8200"
VAULT_TOKEN = "dev-only-token"   # printed by `vault server -dev`

HEADERS = {
    "X-Vault-Token": VAULT_TOKEN,
    "Content-Type": "application/json",
}


def create_secret():
    payload = {"data": {"key1": "value1", "key2": "value2"}}
    response = requests.post(
        f"{VAULT_ADDR}/v1/secret/data/app",
        headers=HEADERS,
        data=json.dumps(payload),
        timeout=10,
    )
    response.raise_for_status()
    print("Secret created:", response.json())


def retrieve_secret():
    response = requests.get(
        f"{VAULT_ADDR}/v1/secret/data/app",
        headers=HEADERS,
        timeout=10,
    )
    response.raise_for_status()
    print("Secret retrieved:", response.json()["data"]["data"])


if __name__ == "__main__":
    create_secret()
    retrieve_secret()

Where it fits

Vault is not a network tool, but it sits underneath most network automation that reaches production. The moment a playbook needs device credentials, an API token for a source of truth, or a certificate to talk to a telemetry collector, the question of where those live stops being theoretical. Answering it once, centrally, is cheaper than answering it per-pipeline.

Vault is a product licensed by HashiCorp. See hashicorp.com for current licensing terms.