Vaults

Working with vaults

Create a vault

Run valt0 init <vault> in your terminal to create a new vault.

$valt0 init prod

This makes an empty vault called prod.valt0 in the folder you are in.

It prints the vault's id and its key. Save the key: every other command asks for it, it is printed once, and a vault whose key is lost cannot be opened again.

The command in full is on the CLI reference.

Store a secret

Run valt0 store <vault>:<name> in your terminal to store a secret.

$valt0 store prod:STRIPE_KEY

This puts a secret called STRIPE_KEY into prod.valt0.

Valt0 asks for the vault key. Once the vault is unlocked, type the value you want to store.

The command in full is on the CLI reference.

See what is in a vault

Run valt0 list <vault> in your terminal to list the secrets contained in the vault.

$valt0 list prod

This asks for the vault key, then prints the names of the secrets in prod.valt0.

The names only, never the values. Those come out one at a time, with valt0 get.

The command in full is on the CLI reference.

Get a secret's value

Run valt0 get <vault>:<name> in your terminal.

$valt0 get prod:STRIPE_KEY

This asks for the vault key, then prints that one value.

The command in full is on the CLI reference.

Update a secret

Run valt0 store <vault>:<name> --force in your terminal to update an existing secret.

$valt0 store prod:STRIPE_KEY --force

Notice the use of the --force flag to write over its value.

Valt0 asks for the key, then for the new value.

The command in full is on the CLI reference.

Delete a secret

Run valt0 rm <vault>:<name> in your terminal to remove a secret from the vault.

$valt0 rm prod:STRIPE_KEY

This asks for the vault key, then takes that secret out of prod.valt0.

The command in full is on the CLI reference.

Get a vault's id

Run valt0 info <vault> in your terminal to print the vault's id.

$valt0 info prod

No key needed. The id is public, and info never opens the vault.

The command in full is on the CLI reference.

Use a vault from your app

An application reads a vault through a client, rather than by opening the file itself.

The client asks the local service that is already running on the machine. Before the service can use a vault, that vault has to be imported with valt0 import.

When developing, an app running inside a container still has to reach the Valt0 service on your host. Check From a container to learn more.

When deploying, you will need to have Valt0 installed on the server/container. Check Deployment to learn more.

To learn more about integrating Valt0 into your apps check Clients.