Skip to main content
HashiCorp Vault’s authentication methods allow you to control how clients authenticate and obtain tokens. While the Vault UI and API offer full functionality, the Vault CLI (vault) provides a fast, scriptable approach to enable, disable, list, tune, and configure auth methods.

vault auth Subcommands

Use vault auth help <subcommand> for in-depth usage details and examples.

Enabling an Auth Method

By default, Vault mounts an auth method at a path matching its type:
To customize the mount path, include -path:
You can also add a description for clarity:

Disabling an Auth Method

When disabling, reference the mount path, not the auth type:
Specifying the wrong mount path will have no effect. Always verify the path with vault auth list before disabling.

Listing Enabled Auth Methods

Run vault auth list to view mounts, types, accessors, and descriptions:

Tuning an Auth Method

Adjust TTLs or other parameters with vault auth tune. For example, set a default lease TTL of 30 minutes and a max lease TTL of 1 hour:

Viewing Command Help

To get usage and flag information for any subcommand:

Command Breakdown

Each vault auth invocation follows this pattern:
  • vault — Vault CLI binary
  • auth — Auth methods subsystem
  • <subcommand>enable, disable, list, tune, or help
  • [options] — Flags like -path or -description
  • <mount-path-or-type> — Type for enable; mount path for disable and tune

Configuring an Enabled Auth Method

Once mounted, interact under the auth/ prefix. To create an AppRole role named vault-course:
Here, each flag sets TTLs or usage limits for the role.

Next Steps

You now know how to enable, disable, list, tune, and configure Vault auth methods via the CLI. In the next lesson, we’ll explore advanced options, automation patterns, and best practices for securing auth backends.

Watch Video