---
title: "Get started with E2E Secrets Management"
description: "Create your first E2E secret store, get its address and token from the credentials email, and store and read a value with the bao command-line tool."
content_type: "get-started"
product: "secrets"
platform: "MyAccount"
url: "/myaccount/secrets/get-started/"
---

# Get started with E2E Secrets Management

<!-- cspell:ignore OpenBao openbao bao -->

Create a secret store, put one value in it, and read it back from your own terminal.

You need:

- Permission to create secrets in the project. An **Admin** or a **Project Lead** can always create
  secrets; any other user needs a policy set that allows it. MyAccount displays **Create New
  Secret** to users who have permission to create secrets. See
  [Choose a role for a user](/myaccount/account/how-to/choose-a-role-for-a-user/) and
  [Create a policy set](/myaccount/account/how-to/create-a-policy-set/).
- On a prepaid account, enough infra credits for 24 hours of the plan's hourly price.

## Create a secret

1. In the MyAccount side menu, click **E2E Secrets Management**. The list of your secrets opens for
   the project and region selected in MyAccount.
2. Click **Create New Secret**. **Create Secret** opens.
3. In **Name**, keep the suggested name that starts with `E2E-Secret-`, or enter a name of your own
   such as `payments-prod`. A name takes up to 50 characters: letters, digits, hyphens, and
   underscores.
4. Under **Select Plan:**, compare each plan's **RAM** and **Storage** in GB, and its hourly and
   monthly **Price**. For a first store, the smallest plan is enough: you can upgrade to a larger
   plan later and keep everything stored in it. Click **Select** on the plan you want. Its button
   then reads **Selected**.
5. Click **Create Secret**. The button is available when the name is valid and a plan is selected.

MyAccount shows **Vault created successfully** and returns to the list, where your secret shows
**Creating**. The list updates by itself while the secret is being set up. When
the status reads **Running**, the store is ready, and billing starts.

## Get the address and token

When the secret reaches **Running**, E2E emails the account owner a link to its credentials,
whichever user created the secret.

1. Open the email and click the link. A page opens with the store's **token** and **domain**, and
   the time the link expires.
2. Copy the token and the domain, and save them in a password manager or another safe place.

The link works for 168 hours (seven days), and you can open it as many times as you like in that
time. The credentials page is the only place to get the token. MyAccount shows the domain too,
under **Domain** on the secret's **Info** tab.

The domain looks like `openbao-<number>.e2enetworks.net`, where the number is your secret's id. You
reach the store over HTTPS on the standard port, 443, so the address needs no port number.

## Store your first value

Install the `bao` command-line tool on your computer, following the
[OpenBao installation guide](https://openbao.org/docs/install/).

1. Point `bao` at your store. Replace `<domain>` with the domain from the credentials page, and
   `<token>` with the token:

   ```bash
   export VAULT_ADDR="https://<domain>"
   export VAULT_TOKEN="<token>"
   ```

2. Sign in with the token:

   ```bash
   bao login $VAULT_TOKEN
   ```

   `bao` confirms that you are signed in and lists `default` among the token's policies.

3. List the secrets engines turned on in your store:

   ```bash
   bao secrets list
   ```

   If `secret/` is not in the list, turn on the key-value engine at that path:

   ```bash
   bao secrets enable -path=secret kv-v2
   ```

4. Store a database password as a value under the name `app`. Replace `<password>` with the
   password you want to store:

   ```bash
   bao kv put secret/app db_password="<password>"
   ```

5. Read it back:

   ```bash
   bao kv get secret/app
   ```

   `bao` prints the value you stored, along with its version number.

## What to do next

- [Connect to a secret](/myaccount/secrets/how-to/connect-to-a-secret/): update and delete values,
  create a token for each application, and read values from Python.
- [Upgrade a secret](/myaccount/secrets/how-to/upgrade-a-secret/): move to a plan with more RAM and
  storage when your store grows.
- [E2E Secrets Management FAQ](/myaccount/secrets/faq/): what the token can do, how long it lasts,
  and how a secret is billed.