How to Keep Passwords and API Keys Out of Code With Vault or OpenBao

Step by step

1. Try it in dev mode

   Dev mode runs in memory with a root token printed on screen. Use it only to learn.

   vault server -dev
   export VAULT_ADDR=http://127.0.0.1:8200
   

2. Store a secret

   The KV engine stores key/value secrets with versions.

   vault kv put secret/billing-app db_password='S3cure-Example' api_key='abc123'
   

3. Read a secret

   Applications and scripts read only the field they need.

   vault kv get -field=db_password secret/billing-app
   

4. Limit access with policies

   Give each application read access to its own path only.

   # billing-app.hcl
   path "secret/data/billing-app" {
     capabilities = ["read"]
   }
   
   vault policy write billing-app billing-app.hcl
   

5. Authenticate applications properly

   Use AppRole, Kubernetes or cloud identity auth instead of long-lived tokens, so each app proves who it is.

6. Run it in production

   Use a production configuration with TLS, integrated storage (Raft) on three nodes, and auto-unseal with a KMS or HSM. Back up the storage and protect the unseal keys.

7. Rotate secrets

   Use dynamic database credentials or scheduled rotation, so a leaked password stops working quickly.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.