Vault: Error with Intro Guide - "Your First Secret"

[tkambler]

I started the vault server in dev mode, as instructed by the intro. I left that instance running in the foreground and opened a new shell. I attempted to write my first secret:

vagrant@host1:~$ vault status
Sealed: false
Key Shares: 1
Key Threshold: 1
Unseal Progress: 0

High-Availability Enabled: false
vagrant@host1:~$ vault write secret/hello value=world
Error writing data to secret/hello: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/secret/hello
Code: 400. Errors:

* missing client token

I received a _missing client token_ error. I presume I need to set the VAULT_TOKEN environment variable, in addition to the VAULT_ADDR environment variable? The guide makes no mention of this.

See: https://github.com/hashicorp/vault/blob/master/website/source/intro/getting-started/first-secret.html.md

[jefferai]

The token should be getting populated into ~/.vault-token by the dev command. Is there a token in there? What version of Vault?

[tkambler]

It is. I discovered the source of the problem - it's my fault. Closing this out.

[brianchoate]

I ran into the same issue. I was running the server under another user. I would suggest adding a note to the document about the .vault-token file.

[excalq]

I may add that I'm learning Vault via its Docker image (https://hub.docker.com/_/vault/). Using this to run a Dev mode instance, then docker exec -it --env VAULT_ADDR=http://127.0.0.1:8200 vault vault write secret/hello value=world to test writing secrets, I encounter the name problem, having this non-obvious solution.

Of course issuing docker exec -it vault sh -c "echo 'myroot' >> ~/.vault-token" does resolve it. My only hope here is to encourage documentation of this fact. (In the tutorial, and on the Docker Hub page.)

[jefferai]

@excalq Why not just use the VAULT_TOKEN env var?

[lusitania]

I lost an hour trying to figure out why I'm getting this error. Seriously?! After over two years this hasn't been addressed in the for-noops-tutorial? Why bother using the "learning" platform, then?!

For the record: I've set

export VAULT_TOKEN=$VAULT_DEV_ROOT_TOKEN_ID

to interface my Vault dev server (official Docker image) with a local Vault binary.

My guess is that VAULT_DEV_ROOT_TOKEN_ID isn't even read by the CLI since there's no mention in https://www.vaultproject.io/docs/commands/.