Skip to main content
Vault initialization is a one-time operation that prepares your storage backend to securely store and manage secrets. During this step, Vault generates encryption keys, shards them, and issues an initial root token. Initialization must be performed exactly once per Vault cluster—never re-initialize after a restore or node failure.

​
What Happens During Initialization

When you run:
Vault will:
  1. Generate a master key that encrypts the data-encryption key.
  2. Create a data-encryption key for all subsequent operations.
  3. Split the master key into key shares (using Shamir’s Secret Sharing) or generate recovery keys if an auto-unseal mechanism is enabled.
  4. Issue the initial root token for first-time authentication.
Initialization writes to your storage backend only once. If your cluster is lost or restored from backup, you skip initialization and go straight to unsealing.

​
Key Shares, Thresholds, and Recovery Keys

By default:
  • Key shares: 5
  • Threshold: 3 (number of shares needed to unseal)
Customize these values:
If you use a cloud KMS or HSM for auto-unseal, Vault generates recovery keys instead of traditional unseal keys. These recovery keys are only needed for manual recovery or re-sealing.

​
Encrypting Unseal Keys and Root Token

Protect your unseal/recovery keys and root token with PGP encryption. Supply one or more public keys during initialization:
Each key share (and the root token, optionally) is encrypted to the corresponding PGP public key. Only private key holders can decrypt them.

​
Initialization Methods

Vault supports three initialization interfaces:

​
CLI Examples

Default initialization:
Custom shares, threshold, and PGP encryption:

​
Post-Initialization Steps

  1. Auto-Unseal
    Vault contacts the configured KMS/HSM and unseals automatically.
  2. Manual Unseal
    Supply unseal key shares on a single Vault node:
  3. Authenticate
    Log in with the initial root token:
Once unsealed and authenticated, you can configure policies, enable secrets engines, and onboard applications.

Watch Video