#vault #client #secret #hashi-corp #key #initialization #api-client


Vault Client - initialize and monitor Hashicorp Vault nodes

11 releases

0.0.10 Aug 31, 2023
0.0.9 Mar 23, 2023
0.0.8 Jan 17, 2023
0.0.7 Nov 18, 2022
0.0.3 Oct 20, 2022

#254 in Asynchronous

Download history 66/week @ 2024-02-19 57/week @ 2024-02-26 1/week @ 2024-03-11 109/week @ 2024-04-01

110 downloads per month

MPL-2.0 license

1.5K SLoC

A client library for working with Vault through its REST api.


Initialization and Setup

  • Generation of clear or encrypted unseal keys
  • Generation of root token
  • Generation of clear or encrypted recovery keys
  • Configuring transit keys and transit unseal


  • Create, update, and list policies
  • Attach policies to userpass users


  • Getting status

Username/Password Authentication

  • Create user and get details
  • Update passwords
  • List users
  • Login (validate password and get Vault token)
  • Delete


See the warning on REST api:

Backwards compatibility: At the current version, Vault does not yet promise backwards compatibility even with the v1
prefix. We'll remove this warning when this policy changes. At this point in time the core API
(that is, sys/ routes) change very infrequently, but various secrets engines/auth methods/etc. sometimes have minor
changes to accommodate new features as they're developed.

The above warning means this library could potentially break with newer versions of Vault.

The library is experimental, and tested with Vault 1.11 through 1.13.

GPG Key Generation

To demo using PGP (GPG) to encrypt the unseal keys and root tokens generated by Vault, you can create several fake users, each with their own key pair.

$ gpg --quick-generate-key operator1@testuri.org
$ gpg --quick-generate-key operator2@testuri.org
$ gpg --quick-generate-key operator3@testuri.org
$ gpg --quick-generate-key root-user@testuri.org

Listing key pairs having private keys:

$ gpg -K

Export the public keys of each key pair:

$ gpg --output operator1.pgp --export operator1@testuri.org
$ gpg --output operator2.pgp --export operator2@testuri.org
$ gpg --output operator3.pgp --export operator3@testuri.org
$ gpg --output root-user.pgp --export root-user@testuri.org

Note: DO NOT use the "--armor" flag - Vault requires binary public keys.



All library features are available on Linux.


All library features are available on Macs, but because of limitations of Docker networking on Macs, all automated tests that require a live Vault server are disabled.


All library features are available on Windows, but because Hashicorp does not offer a Windows build of the Vault server, all automated tests that require a live Vault server are disabled.


~262K SLoC