Get started with E2E Secrets Management

Create a secret store, put one value in it, and read it back from your own terminal.

You need:

• Permission to create secrets in the project. An Admin or a Project Lead can always create secrets; any other user needs a policy set that allows it. MyAccount displays Create New Secret to users who have permission to create secrets. See Choose a role for a user and Create a policy set.
• On a prepaid account, enough infra credits for 24 hours of the plan’s hourly price.

Create a secret

1. In the MyAccount side menu, click E2E Secrets Management. The list of your secrets opens for the project and region selected in MyAccount.
2. Click Create New Secret. Create Secret opens.
3. In Name, keep the suggested name that starts with E2E-Secret-, or enter a name of your own such as payments-prod. A name takes up to 50 characters: letters, digits, hyphens, and underscores.
4. Under Select Plan:, compare each plan’s RAM and Storage in GB, and its hourly and monthly Price. For a first store, the smallest plan is enough: you can upgrade to a larger plan later and keep everything stored in it. Click Select on the plan you want. Its button then reads Selected.
5. Click Create Secret. The button is available when the name is valid and a plan is selected.

MyAccount shows Vault created successfully and returns to the list, where your secret shows Creating. The list updates by itself while the secret is being set up. When the status reads Running, the store is ready, and billing starts.

Get the address and token

When the secret reaches Running, E2E emails the account owner a link to its credentials, whichever user created the secret.

1. Open the email and click the link. A page opens with the store’s token and domain, and the time the link expires.
2. Copy the token and the domain, and save them in a password manager or another safe place.

The link works for 168 hours (seven days), and you can open it as many times as you like in that time. The credentials page is the only place to get the token. MyAccount shows the domain too, under Domain on the secret’s Info tab.

The domain looks like openbao-<number>.e2enetworks.net, where the number is your secret’s id. You reach the store over HTTPS on the standard port, 443, so the address needs no port number.

Store your first value

Install the bao command-line tool on your computer, following the OpenBao installation guide.

1. Point bao at your store. Replace <domain> with the domain from the credentials page, and <token> with the token:

   export VAULT_ADDR="https://<domain>"
   export VAULT_TOKEN="<token>"

2. Sign in with the token:

   bao login $VAULT_TOKEN

   bao confirms that you are signed in and lists default among the token’s policies.

3. List the secrets engines turned on in your store:

   bao secrets list

   If secret/ is not in the list, turn on the key-value engine at that path:

   bao secrets enable -path=secret kv-v2

4. Store a database password as a value under the name app. Replace <password> with the password you want to store:

   bao kv put secret/app db_password="<password>"

5. Read it back:

   bao kv get secret/app

   bao prints the value you stored, along with its version number.

What to do next

• Connect to a secret: update and delete values, create a token for each application, and read values from Python.
• Upgrade a secret: move to a plan with more RAM and storage when your store grows.
• E2E Secrets Management FAQ: what the token can do, how long it lasts, and how a secret is billed.