token create command creates a new token that can be used for
authentication. This token will be created as a child of the currently
authenticated token. The generated token will inherit all policies and
permissions of the currently authenticated token unless you explicitly define a
subset list policies to assign to the token.
A ttl can also be associated with the token. If a ttl is not associated with the token, then it cannot be renewed. If a ttl is associated with the token, it will expire after that amount of time unless it is renewed.
Metadata associated with the token (specified with
-metadata) is written to
the audit log when the token is used.
If a role is specified, the role may override parameters specified here.
Create a token attached to specific policies:
$ vault token create -policy=my-policy -policy=other-policy Key Value --- ----- token 95eba8ed-f6fc-958a-f490-c7fd0eda5e9e token_accessor 882d4a40-3796-d06e-c4f0-604e8503750b token_duration 768h token_renewable true token_policies [default my-policy other-policy]
Create a periodic token:
$ vault token create -period=30m Key Value --- ----- token fdb90d58-af87-024f-fdcd-9f95039e353a token_accessor 4cd9177c-034b-a004-c62d-54bc56c0e9bd token_duration 30m token_renewable true token_policies [my-policy]
The following flags are available in addition to the standard set of flags included on all commands.
(string: "")- Print only the field with the given name. Specifying this option will take precedence over other formatting directives. The result will not have a trailing newline making it ideal for piping to other processes.
(string: "table")- Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the
(string: "")- Name to associate with this token. This is a non-sensitive value that can be used to help identify created secrets (e.g. prefixes).
(string: "")- Name of the entity alias to associate with during token creation. Only works in combination with -role argument and used entity alias must be listed in allowed_entity_aliases. If this has been specified, the entity will not be inherited from the parent.
(string: "")- Value for the token. By default, this is an auto-generated value. Specifying this value requires sudo permissions.
(k=v: "")- Arbitrary key=value metadata to associate with the token. This metadata will show in the audit log when the token is used. This can be specified multiple times to add multiple pieces of metadata.
(bool: false)- Detach the "default" policy from the policy set for this token.
(bool: false)- Create the token with no parent. This prevents the token from being revoked when the token which created it expires. Setting this value requires sudo permissions.
(duration: "")- If specified, every renewal will use the given period. Periodic tokens do not expire as long as they are actively being renewed (unless
-explicit-max-ttlis also provided). Setting this value requires sudo permissions. Uses duration format strings.
(string: "")- Name of a policy to associate with this token. This can be specified multiple times to attach multiple policies.
(bool: true)- Allow the token to be renewed up to it's maximum TTL.
(string: "")- Name of the role to create the token against. Specifying -role may override other arguments. The locally authenticated Vault token must have permission for
(string: "service")- The type of token to create. Can be "service" or "batch".
(int: 0)- Number of times this token can be used. After the last use, the token is automatically revoked. By default, tokens can be used an unlimited number of times until their expiration.
(duration: "")- Wraps the response in a cubbyhole token with the requested TTL. The response is available via the "vault unwrap" command. The TTL is specified as a numeric string with suffix like "30s" or "5m". This can also be specified via the