HashiCorp Vault token
ID hashicorp_vault_token
DatatypeNot PIIidentifierDraft
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
Token that authenticates a client to HashiCorp Vault. Since Vault 1.10 the prefix names the token type - hvs. for service tokens, hvb. for batch tokens and hvr. for recovery tokens - and at least 24 random characters follow; service tokens in practice are much longer. Vault 1.9 and earlier used the prefixes s., b. and r., which are too short to recognize reliably and are not covered.
- Parent datatype
- Access token
access_token - Categories
- Secrets and credentials (passwords, keys, tokens)
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 70/100 · missing: examples, mapping (Wikidata, Schema.org, ...), translation
- Metacrafter rules
- no detection rule yet
- Supported by tools
- Gitleaks, TruffleHog
Regular expression
^hv[sbr]\.[A-Za-z0-9_.-]{24,}$Python re syntax.
Examples
| Value | Description |
|---|---|
| s.ExampleTokenNotReal0000 invalid | Legacy format of Vault 1.9 and earlier |
| hvs.TooShort invalid | Too short |
Sources
- doc: https://developer.hashicorp.com/vault/docs/concepts/tokens
- other: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
- other: https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/hashicorpvault/hashicorpvaulttoken/hashicorpvaulttoken.go
- other: https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/hashicorpvault/hashicorpvaultbatchtoken/hashicorpvaultbatchtoken.go
Use this record
- Page URL:
http://registry.apicrafter.io/datatype/hashicorp_vault_token - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/secrets/hashicorp_vault_token.yamlon GitHub