Skip to main content
Periodic tokens in Vault are renewable credentials that you can extend indefinitely—provided you renew them before their TTL (time to live) expires. They’re ideal for long-running services or applications that cannot tolerate token expiration or frequent re-authentication.

​
Why Use Periodic Tokens?

  • Unlimited lifetime: No explicit_max_ttl limit (set to 0s).
  • Automatic renewal: Reset the TTL back to the full period on each successful renewal.
  • Safe revocation: You can revoke them at any time without leaving orphaned credentials.
Periodic tokens require careful management. Failing to renew before TTL expiry will invalidate the token and disrupt any dependent service.

​
Required Permissions

You need one of the following to create a periodic token: Here’s an example HCL policy granting the necessary permissions for non-root users:
For more on Vault ACL policies, see Vault Policy Documentation.

​
How Periodic Tokens Work

  1. Initial TTL
    On creation, the token receives a token_duration (e.g., 24h).
  2. Renewal Period
    The period field determines how far into the future you can renew (e.g., 24h).
  3. Infinite Renewal
    With explicit_max_ttl = 0s, you can renew the token indefinitely—until you choose to revoke it.

​
Creating a Periodic Token

Use the Vault CLI to generate a periodic token. In this example, we assign the training policy and set a 24-hour renewal period:
Sample output:
  • token_duration: Initial TTL
  • token_renewable: true
  • period: Renewal window

​
Inspecting a Periodic Token

To view the properties of your token:
Key fields in the output:

​
Renewing a Periodic Token

Call vault token renew before the ttl expires to reset the TTL back to the full period:
Repeat this process indefinitely to keep the token alive.
Automate renewal for long-lived services using a cron job or HashiCorp Consul Template to avoid manual intervention.

​
References

Watch Video