Controlling the Token Lifecycle

Managing tokens effectively is crucial for secure, reliable access to Vault. By choosing the right token type, you can tailor authentication lifecycles to your application’s needs. This guide covers three core scenarios and shows you how to create:

• Periodic service tokens for long-running applications
• Service tokens with usage limits for sensitive actions
• Orphan tokens with independent lifecycles

Periodic Service Tokens

For legacy or long-running applications that cannot handle token rotation, a periodic service token is ideal. It has a finite Time-To-Live (TTL) but no maximum TTL, so you can renew it indefinitely without changing the token string.

vault token create \
  -policy="your-policy" \
  -period="24h"

Service Tokens with Usage Limits

When you need a token to expire automatically after a set number of uses—such as for one-time administrative tasks—use a service token with the num_uses parameter. Vault revokes the token once it hits the usage threshold.

vault token create \
  -policy="sensitive-action" \
  -num_uses=3

Orphan Tokens

To prevent your token’s lifecycle from being tied to a parent token—ensuring its expiration or revocation only follows its own rules—create an orphan token. This token has no parent relationship, giving you full control over its lifecycle.

vault token create \
  -policy="independent-policy" \
  -orphan

Summary Table

Below is a quick reference comparing each token type, its primary use case, and example CLI commands.

Links and References

• HashiCorp Vault Token Documentation
• Vault CLI Commands