otty / apps

All apps/Vault

Vault

vault

Vault is a tool for securely accessing secrets.

Runs as vault|macOS, Linux, Windows|developer.hashicorp.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Vault in your home directory Every rule on this page, by file

token_helper = "/Users/octocat/bin/vault-token-helper.sh"machine-local

Each machine keeps its own copy of these.

· ~/.vault-token Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/vault/otty.tomlThe file this page is generated from

id = "vault"

name = "Vault"

homepage = "https://developer.hashicorp.com/vault"

description = "Vault is a tool for securely accessing secrets."

icon = "SimpleIcons:vault"

executables = ["vault"]

[dotfiles]

# hashicorp/vault, api/cliconfig/config.go:

# // defaultConfigPath is the default path to the configuration file

# defaultConfigPath = "~/.vault"

# // Config is the CLI configuration for Vault that can be specified via

# // a `$HOME/.vault` file which is HCL-formatted (therefore HCL or JSON).

# VAULT_CONFIG_PATH overrides it. The file has exactly one field, token_helper.

paths = ["~/.vault"]

exclude = []

# https://developer.hashicorp.com/vault/docs/commands/token-helper — "the Vault

# CLI includes a token helper that caches tokens from any enabled

# authentication backend in a ~/.vault-token file". The whole file is the

# token.

secret = ["~/.vault-token"]

# Read once per command by a process that then exits.

side_effect = false

# api/cliconfig/config.go on token_helper: "the executable/command that is

# executed for storing and retrieving the authentication token for the Vault

# CLI". It is a path to a program installed on this machine, so it does not

# travel — and pointing it at a path that does not exist on the other machine

# breaks every `vault login` there.

# The helper is one the user pointed Vault at on this box, so the path is kept

# for rebuilding it and applied to no other.

[[dotfiles.machine_lines]]

file = "~/.vault"

match = { prefix = ["token_helper"] }

scope = "backup"

[commands]

format = 1

label = "Vault"

description = "HashiCorp Vault CLI. Forms cover read, kv get, kv put and status; auth and server options are left out."

quality = "ai-draft"

base = "fig:vault"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"

license = "MIT"

[[commands.subcommand]]

path = ["read"]

label = "Read path"

description = "Read data from a Vault path."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "path"

label = "Path"

type = "string"

position = 0

min = 1

suggestions = [{ value = "secret/foo", label = "secret/foo" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "field"

label = "Only this field"

type = "string"

option = ["-field"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "format"

label = "Output format"

type = "enum"

option = ["-format"]

choices = [{ value = "table", label = "table" }, { value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "pretty", label = "pretty" }]

sources = ["fig"]

[[commands.subcommand.task]]

id = "read"

label = "Read"

fields = ["path", "field", "format"]

required = ["path"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["path", "field", "format"]

[[commands.subcommand]]

path = ["kv", "get"]

label = "KV get"

description = "Get a secret from the key-value store."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "path"

label = "Path"

type = "string"

position = 0

min = 1

suggestions = [{ value = "secret/foo", label = "secret/foo" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "format"

label = "Output format"

type = "enum"

option = ["-format"]

choices = [{ value = "table", label = "table" }, { value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "pretty", label = "pretty" }]

sources = ["fig"]

[[commands.subcommand.task]]

id = "get"

label = "Get secret"

fields = ["path", "format"]

required = ["path"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["path", "format"]

[[commands.subcommand]]

path = ["kv", "put"]

label = "KV put"

description = "Write key=value pairs to a secret. Values appear in shell history; prefer K=@file.json for sensitive data."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "key"

label = "Path"

type = "string"

position = 0

min = 1

suggestions = [{ value = "secret/foo", label = "secret/foo" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "data"

label = "Data (K=V)"

description = "Pairs like name=value or name=@file.json."

type = "string"

position = 1

multiple = true

min = 1

sources = ["fig"]

[[commands.subcommand.field]]

id = "cas"

label = "Check-and-set version"

type = "string"

option = ["-cas"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "put"

label = "Write secret"

fields = ["key", "data"]

required = ["key", "data"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["key", "data", "cas"]

[[commands.subcommand]]

path = ["status"]

label = "Status"

description = "Print the seal and HA state of the Vault server."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/vault.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "format"

label = "Output format"

type = "enum"

option = ["-format"]

choices = [{ value = "table", label = "table" }, { value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "pretty", label = "pretty" }]

sources = ["fig"]

[[commands.subcommand.task]]

id = "status"

label = "Status"

fields = ["format"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["format"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/vault. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out. None of them splits token_helper for you — that part is Otty’s own sync, or a template you write by hand.