Token auth method

Supports custom GUI login

This method can be chosen as a default or backup login method for Vault Enterprise GUI users. Refer to the Manage custom login options guide for more details.

NOTE: The Token auth method cannot be configured with Vault's built-in Login MFA feature.

The token auth method is built-in and automatically available at /auth/token. It allows users to authenticate using a token, as well to create new tokens, revoke secrets by token, and more.

When any other auth method returns an identity, Vault core invokes the token method to create a new unique token for that identity.

The token store can also be used to bypass any other auth method: you can create tokens directly, as well as perform a variety of other operations on tokens such as renewal and revocation.

Please see the token concepts page dedicated to tokens.

Authentication

Via the CLI

$ vault login token=<token>

Via the API

The token is set directly as a header for the HTTP API. The header should be either X-Vault-Token: <token> or Authorization: Bearer <token>.

API

The Token auth method has a full HTTP API. Please see the Token auth method API for more details.