01 Overview
Vault stores API keys, database credentials, and certificates behind an audited, policy-controlled API instead of scattering them in config files. It can also generate short-lived, dynamic credentials on demand.
→ official documentation02 Installation
Pick a platform. Each step is copy-pasteable on its own.
01 Install prerequisites
sudo apt-get update && sudo apt-get install -y gnupg software-properties-common curl
02 Add the HashiCorp GPG key and repo
wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
03 Install Vault
sudo apt-get update && sudo apt-get install -y vault
04 Verify
vault -version
01 Add the HashiCorp repo
sudo dnf install -y dnf-plugins-core sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
02 Install Vault
sudo dnf install -y vault
03 Verify
vault -version
01 Install via Homebrew
brew tap hashicorp/tap brew install hashicorp/tap/vault
02 Verify
vault -version
Note — commands assume sudo privileges and an up-to-date package index. Pin a specific version in production rather than tracking latest.
03 Install script
The steps above bundled into a single idempotent shell script for provisioning boxes unattended.
install-vault.sh
Ubuntu/Debian target · safe to re-run · exits non-zero on failure
04 Cheatsheet
The commands reached for most often once Vault is installed.
| Command | What it does |
|---|---|
| vault server -dev | Run a throwaway dev server (never for production) |
| export VAULT_ADDR='http://127.0.0.1:8200' | Point the CLI at a Vault server |
| vault login | Authenticate the CLI session |
| vault kv put secret/app key=value | Write a KV secret |
| vault kv get secret/app | Read a KV secret |
| vault policy write name policy.hcl | Upload an access policy |
| vault operator unseal | Unseal a Vault after startup |