> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Managing Tokens using the CLI
> This article explains how to manage Vault tokens using the CLI for authentication and access control in HashiCorp Vault.
Vault tokens are the primary authentication mechanism for interacting with HashiCorp Vault. Using the Vault CLI, you can create, inspect, renew, revoke, and check capabilities of tokens to tailor access control for your applications and users.
## Table of Contents
1. [Creating a Token](#1-creating-a-token)
2. [Looking Up a Token](#2-looking-up-a-token)
3. [Renewing a Token](#3-renewing-a-token)
4. [Revoking a Token](#4-revoking-a-token)
5. [Checking Token Capabilities](#5-checking-token-capabilities)
6. [References](#6-references)
***
## 1. Creating a Token
Use the `vault token create` command to generate a new token with a specified TTL (time-to-live) and attached policies.
```bash theme={null}
vault token create \
-ttl=5m \
-policy=training
```
Example output:
```text theme={null}
Key Value
--- -----
token s.12VNpg4OA9tTdCd4V60DuDRK
token_accessor lMIaz4Tn1t57wKXdsfNv7vlm
token_duration 5m
token_renewable true
policies ["default" "training"]
```
| Property | Description |
| ---------------- | --------------------------------------------------------- |
| token | Authentication token string |
| token\_accessor | String used to renew or revoke without exposing the token |
| token\_duration | Initial TTL before expiration |
| token\_renewable | Indicates if the token can be renewed |
| policies | List of Vault policies attached to the token |
You can further customize a token with `-display_name`, multiple policies, and an explicit maximum TTL.
```bash theme={null}
vault token create \
-display_name=jenkins \
-policy=training,certs \
-ttl=24h \
-explicit-max-ttl=72h
```
* `-display_name`: Human-friendly identifier
* `-policy`: Comma-separated Vault policies
* `-ttl`: Initial lifetime (e.g., `24h`)
* `-explicit-max-ttl`: Maximum lifetime across renewals
***
## 2. Looking Up a Token
Inspect metadata for any token by running:
```bash theme={null}
vault token lookup
```
Example:
```bash theme={null}
vault token lookup s.12VNpg4OA9tTdCd4V60DuDRK
```
```text theme={null}
Key Value
--- -----
accessor lMIaz4Tn1t57wKXdsfNv7vlm
creation_time 1630613718
creation_ttl 5m
display_name jenkins
expire_time 2021-09-02T16:23:02Z
explicit_max_ttl 72h
id s.12VNpg4OA9tTd4V60DuDRK
issue_time 2021-09-02T16:15:18Z
last_renewal 2021-09-02T16:18:02Z
num_uses 0
orphan false
path auth/token/create
policies [default training certs]
renewable true
ttl 3m12s
type service
```
If you omit the identifier, Vault returns details for the token in your `$VAULT_TOKEN`:
```bash theme={null}
vault token lookup
```
***
## 3. Renewing a Token
Extend a token’s TTL using `vault token renew`. You can renew by token ID or accessor:
```bash theme={null}
# Renew by token ID
vault token renew s.12VNpg4OA9tTdCd4V60DuDRK
# Renew by accessor
vault token renew -accessor lMIaz4Tn1t57wKXdsfNv7vlm
```
Renewal output confirms the new TTL and policies:
```text theme={null}
Key Value
--- -----
token s.12VNpg4OA9tTdCd4V60DuDRK
token_duration 5m
renewable true
policies ["default" "training"]
```
***
## 4. Revoking a Token
To immediately invalidate a token, use:
```bash theme={null}
vault token revoke
```
Example:
```bash theme={null}
vault token revoke s.12VNpg4OA9tTdCd4V60DuDRK
```
Revoking a token is irreversible. Any sessions or processes using that token will lose access immediately.
***
## 5. Checking Token Capabilities
Determine which operations a token can perform on a specific path:
```bash theme={null}
vault token capabilities
```
Example:
```bash theme={null}
vault token capabilities s.dhtIk8VsE3Mj61PuGP3ZfFrg kv/data/apps/webapp
```
Output:
```text theme={null}
create, list, read, sudo, update
```
This helps you audit and verify permissions for service accounts or automation tools.
***
## 6. References
* [Vault CLI Reference](https://www.vaultproject.io/docs/commands)
* [Authentication Methods](https://www.vaultproject.io/docs/auth)
* [Vault Token Authentication](https://www.vaultproject.io/docs/concepts/tokens)