Skip to main content
In this guide, we’ll cover how to work with HashiCorp Vault Batch Tokens. You’ll learn how to inspect existing tokens, create and revoke service tokens, generate batch tokens (including orphaned ones), and understand their key characteristics. Finally, you’ll see how to authenticate using a batch token.

​
Inspecting Existing Tokens

First, verify your current root token accessor:
Example output:
List all token accessors in Vault:
Since only the root token exists, that accessor is the one you see.

​
Creating and Revoking a Service Token

To create a standard service token with a specific policy:
Sample response:
Now list accessors again:
Revoke the new service token by its accessor:
Any login attempt with the revoked token fails:
Granting list and revoke permissions on auth/token/accessors lets users revoke any token by accessor. Assign this capability with care.

​
Creating a Batch Token

Batch tokens are designed for high-performance use cases. They are longer, non-renewable, and have no accessor.
  • Prefix hvb. indicates a HashiCorp Vault Batch Token.
  • No accessor means it won’t appear in auth/token/accessors.

​
Inspecting the Batch Token

Retrieve its metadata:
Because orphan: false, this token has a parent and cannot be used across performance-replicated clusters.

​
Creating an Orphaned Batch Token

An orphaned batch token has no parent, making it usable across performance clusters:
Verify the orphan status:

​
Batch Token Characteristics

Batch tokens cannot be renewed or revoked. Plan token lifecycles accordingly.

​
Using a Batch Token

Authenticate and export the token:
If you lack permissions, listing secrets fails:
Clean up by unsetting the token:
You’ve now learned how to create, inspect, and securely use Vault Batch Tokens. For more details, see the Vault Tokens documentation.

Watch Video

Practice Lab