> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/2023-2/secrets/hashicorp/configure/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure HashiCorp Vault

> Start and unseal the Vault server

This guide shows you how to configure and start the HashiCorp Vault server.

## Start the Vault server

### Navigate to Vault directory

Navigate to `/opt/vault`.

```bash
cd /opt/vault
```

### Create configuration file

Create a config file with an `hcl` file extension.

```bash
touch config.hcl
```

### Edit configuration

Add the following configuration to the file.

```hcl
storage "raft" {
  path    = "/opt/vault/data"
  node_id = "node1"
}

listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = "true"
}

api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"
ui = true
```

### Start Vault server

Run Vault using the configuration file.

```bash
vault server -config=/opt/vault/config.hcl
```

This starts the Vault server using the newly created config file.

### Open second terminal

Open a second terminal window. Keep the first terminal window open—closing it will stop the Vault server.

## Unseal the Vault server

### Initialize Vault

In the second terminal window, run the following commands.

```bash
export VAULT_ADDR='http://127.0.0.1:8200'
vault operator init
```

### Save key information

Copy the unseal keys and initial root token from the terminal output into a text file. You'll need this information for the next steps.

### Unseal Vault

Run the unseal command three times using three different unseal keys from your saved information.

```bash
vault operator unseal
```

By default, Vault generates five unseal keys with a threshold of three keys. You need to enter three different keys to unseal the vault. Any three of the five keys will work.

### Log in to Vault

Log in using the initial root token you saved earlier.

```bash
vault login <INITIAL_ROOT_TOKEN>
```

### Generate One Time Password

Generate a One Time Password (OTP).

```bash
vault operator generate-root -init
```

Copy the OTP to your text file.

### Generate encoded token

Generate an encoded token by running this command three times with three unseal keys (you can use the same keys from step 3).

```bash
vault operator generate-root
```

Copy the encoded key to your text file.

### Decode token

Decode the token to obtain a new root key. Replace `$ENCODED_TOKEN` and `$OTP` with your actual values.

```bash
vault operator generate-root -decode=$ENCODED_TOKEN -otp=$OTP
```

### Store root key

Create a `token.txt` file in the `/opt/vault` directory and save the new root key in this file.

```bash
echo "YOUR_ROOT_KEY" > /opt/vault/token.txt
```

## Next steps

#### [Enable Secrets Engine](/itential-platform/secrets/hashicorp/enable-kv-v2-secrets-engine)

#### [Create secrets](./create-secrets)

> Start and unseal the Vault server