Vault Authentication using the CLI

In this guide, you’ll learn how to authenticate to HashiCorp Vault using the CLI. Once you’ve enabled an auth method (e.g., Token, Userpass, OIDC, AppRole), you can log in and cache your client token for seamless future requests.

Overview of Auth Methods
1. Authenticating with an Existing Token
2. Authenticating with Userpass
3. Token Helper & Caching
4. Machine-Friendly JSON Authentication (AppRole)
Next Steps
References

Overview of Auth Methods

Auth Method	CLI Usage	Description
Token	`vault login <token>`	Authenticate with a pre-generated Vault token
Userpass	`vault login -method=userpass username=<user>`	Username/password authentication
AppRole	`vault write auth/approle/login ...`	Machine-to-machine auth for automation
OIDC	`vault login -method=oidc`	Single Sign-On via OIDC providers

1. Authenticating with an Existing Token

If you already have a Vault token, simply run:

vault login s.fhNBot4hRBfDWJ2jBdTwimaG

Example output:

Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run "vault login" again.
Future Vault requests will automatically use this token.

Key                   Value
---                   -----
token                 s.fhNBot4hRBfDWJ2jBdTwimaG
token_accessor        502YCRmp1sfZ8YcdfbYes9fj
token_duration        ∞
token_renewable       false
token_policies        ["root"]
identity_policies     []
policies              ["root"]

By default, vault login uses the token auth method and caches your token for subsequent commands.

2. Authenticating with Userpass

Use the userpass auth method when you don’t have a token but have Vault credentials:

vault login -method=userpass username=bryan
Password (will be hidden):

After providing the correct password, you’ll see:

Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run "vault login" again.
Future Vault requests will automatically use this token.

Key                   Value
---                   -----
token                 s.jgSgKqDOnaOxu30ffCOrZWB0
token_accessor        SpiJi6bghz4huS8MG4HsLmNp
token_duration        768h
token_renewable       true
token_policies        ["admin" "default"]
identity_policies     []
policies              ["admin" "default"]
token_meta_username   bryan

Command Breakdown

vault login
The Vault CLI subcommand for authentication.
-method=userpass
Selects the Userpass auth method.
username=bryan
Supplies the required username parameter.

If you have multiple mounts of the same auth type, add -path=<mount_path> to specify the correct one.

3. Token Helper & Caching

After a successful vault login, the CLI writes your token to ~/.vault-token. This token helper:

Stores your token so you don’t have to re-enter it for every command
Automatically reads and attaches the token to subsequent API calls

Keep ~/.vault-token secure. Anyone with access can perform Vault operations under your identity.

4. Machine-Friendly JSON Authentication (AppRole)

For CI/CD pipelines or automation, request JSON output and parse the token:

export VAULT_ADDR="https://vault.example.com:8200"
export VAULT_FORMAT=json

OUTPUT=$(vault write auth/approle/login \
  role_id="12345657" secret_id="1nv84nd3821s")

VAULT_TOKEN=$(echo "$OUTPUT" | jq -r '.auth.client_token')

vault login "$VAULT_TOKEN"

Steps Explained:

export VAULT_FORMAT=json
Instructs the Vault CLI to return JSON.
vault write auth/approle/login ...
Authenticates via AppRole and captures the full JSON response in OUTPUT.
jq -r '.auth.client_token'
Extracts the client token.
vault login "$VAULT_TOKEN"
Caches the token for subsequent CLI calls.

Next Steps

Now that you’ve authenticated:

Read secrets: vault kv get secret/my-app/config
Write secrets: vault kv put secret/my-app/config key=value
Renew tokens: vault token renew

Explore more in the Vault CLI documentation.

Introduction

Introduction to Vault

Learning the Vault Architecture

Installing Vault

Compare Authentication Methods

Create Vault Policies

Assess Vault Tokens

Compare and Configure Secrets Engines

Vault Agent

Vault Replication

Vault Authentication using the CLI

Table of Contents

Overview of Auth Methods

1. Authenticating with an Existing Token

2. Authenticating with Userpass

Command Breakdown

3. Token Helper & Caching

4. Machine-Friendly JSON Authentication (AppRole)

Next Steps

References

Watch Video

​Table of Contents

​Overview of Auth Methods

​1. Authenticating with an Existing Token

​2. Authenticating with Userpass

​Command Breakdown

​3. Token Helper & Caching

​4. Machine-Friendly JSON Authentication (AppRole)

​Next Steps

​References

Watch Video

Table of Contents

Overview of Auth Methods

1. Authenticating with an Existing Token

2. Authenticating with Userpass

Command Breakdown

3. Token Helper & Caching

4. Machine-Friendly JSON Authentication (AppRole)

Next Steps

References