Skip to main content
Version: 0.8

HashiCorp Vault

TokenTimer scans Vault KV v2 and PKI mounts over the REST API to discover secrets and certificates with expiration dates. No SDK or agent is required.

Vault URL format: https://vault.example.com:8200

Credential setup​

  1. Go to Vault UI → Access → Tokens → Create Token
  2. Set policies: read on KV v2 mounts and read on PKI mounts
  3. Set a TTL (recommended: 1-7 days for one-time use)
  4. Copy the token immediately (it will not be shown again)
  5. Revoke after use. The token is used once and never stored.

Permissions required​

  • read + list on KV v2 mount paths and metadata paths
  • read + list on PKI mounts

TokenTimer only reads metadata and certificate contents (for expiration parsing). No secret values are stored.

What is discovered​

  • KV v2 secrets: path, name, expiration (if present), auto-detected category/type
  • PKI certificates: serial, subject, issuer, expiration (notAfter)

PEM and base64 DER formats are supported. Smart heuristics auto-map types (for example certificates map to ssl_cert, API keys to api_key).

info

Vault does not support auto-sync on self-hosted TokenTimer. Each scan is a one-time, manual action; credentials are used once and never stored.