Skip to main content
In this tutorial, you’ll learn how to configure and use Vault’s AppRole authentication method to grant machine clients read access to a KV secrets engine. By the end, you’ll create a policy, define an AppRole, and retrieve a client token using Role ID and Secret ID.

​
Prerequisites

  • A running Vault server
  • VAULT_ADDR environment variable set (e.g., export VAULT_ADDR=http://127.0.0.1:8200)
  • Vault CLI installed and authenticated as an administrator

​
1. Verify Enabled Auth Methods

By default, Vault includes the Token auth method. Let’s confirm:
Example output:
You can also compare common methods:

​
2. Enable AppRole Auth Method

Enable AppRole at the path approle/:
Expected response:

​
3. Define a Read-Only KV Policy

Create a policy file named kv-policy.hcl:
Upload the policy to Vault:

​
4. Create and Configure the AppRole

​
4.1 Create the AppRole

Associate the kv-policy with a new AppRole called automation:

​
4.2 List and Inspect Roles

List all AppRole roles:
Inspect the automation role’s settings:

​
4.3 (Optional) Set a Default Token TTL

Assign a 24-hour default token TTL to the automation role:
Verify the update:

​
5. Retrieve the Role ID

The Role ID is a stable, unique identifier—think of it as a username. Fetch it with:

​
6. Generate a Secret ID

The Secret ID is equivalent to a password. To get a one-time Secret ID, run:
Treat both Role ID and Secret ID as sensitive credentials. Avoid exposing them in logs, version control, or shared terminals.

​
7. Authenticate with AppRole

Now request a Vault token by supplying your Role ID and Secret ID:
Sample response:
You now hold a Vault token, renewable for 24 hours, with read-only access to kv/data/*.
AppRole is ideal for automation and CI/CD pipelines. You can also authenticate via the HTTP API:
POST /v1/auth/approle/login with JSON body:
You have successfully configured Vault’s AppRole auth method. For more details, see the Vault AppRole Authentication Guide.

Watch Video

Practice Lab