HCP CLI overview for HCP Vault Secrets

The HCP CLI supports HCP Vault Secrets using the vault-secrets command group.

Refer to the HCP CLI section for a complete list of all supported vault-secrets commands.

You can login interactively using a web browser or configure the hcp CLI for non-interactive workflows.

The hcp auth login command will authenticate you with the HashiCorp Cloud Platform.

Open a terminal and run hcp auth login.
```
$ hcp auth login
```
A new browser window will open.
Log into the HCP Portal using your username and password.
Return to the terminal, the Successfully logged in! message appears.
The auth login command will try to configure default organization and project. When multiple organizations or projects are detected, you will be prompted to run hcp profile init.
Run hcp profile init to configure (or update) the default profile.
```
$ hcp profile init
```

Use the arrow keys on the keyboard to select an organization.

Example output:

Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
? Multiple organizations found. Please select the one you would like to configure.:
  > example-org-1
  example-org-2
  example-org-1

----- Organization -----
Name:   example-org-1
ID:     11111111-1111-1111-1111-s3sam3st33t

Use the arrow keys on the keyboard to select a project.

Example output:

✓ Organization with name "example-org-1" and ID "11111111-1111-1111-1111-s3sam3st33t" selected
Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
? Multiple projects found. Please select the one you would like to configure.:
  > ProductionProject
  DevelopmentProject

----- Project -----
Name:        ProductionProject
ID:          11111111-1111-1111-1111-c00k1300
Description:

When prompted, type y to configure any service related config. Select vault-secrets, then select the desired app.

Example output:

✓ Organization with name "hashicorp-edu-org" and ID "2570acc0-8d87-4443-a8a8-fcf8cacf750d" selected
✓ Project with name "ProductionProject" and ID "43c763b4-d3f4-4fda-b245-2ab9d0f5d257" selected

Would you like to configure any service related config (y/n)? y

✔ Vault Secrets
Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
? Multiple apps found. Please select the one you would like to configure.:
  > ExampleApplication
  WebApplication

----- Apps -----
Name:   ExampleApplication
Description

You can now use the hcp CLI.

$ hcp vault-secrets open <secret-name>

Secret Name:    secret-name
Type:           kv
Created At:     2024-10-02T13:21:13.417Z
Latest Version: 1
Value:          example

Use the hcp profile set command to configure the CLI to authenticate with the desired HCP organization, project, and HCP Vault secrets app using an HCP service principal. With the values set, the hcp CLI can work with HCP Vault Secrets without human interaction.

Create a service principal and key for the service principal.
Set the HCP_CLIENT_ID and HCP_CLIENT_SECRET environment variables with values from the previous step.
```
$ export HCP_CLIENT_ID=<actual-client-id> HCP_CLIENT_SECRET=<actual-client-secret>
```
Collect the organization ID, project ID, and app name you want to use with the hcp CLI.

Add the organization ID to the default hcp CLI profile.

$ hcp profile set organization_id <org-id> --quiet

Add the organization ID to the default hcp CLI profile.

$ hcp profile set project_id <project-id> --quiet

Add the organization ID to the default hcp CLI profile.

$ hcp profile set vault-secrets/app <app-name> --quiet

You can now use the hcp CLI in an automated manner.
```
$ hcp vault-secrets open <secret-name>
```

Create a secret

Use the vault-secrets command family to create secrets.

You can create a secret by specifying a data file, or piping the secret using STDIN.

$ echo -n "WorstPasswordEver" | hcp vault-secrets secrets create password --data-file=-
Secret Name   Created At                 Latest Version
password      2024-10-04T16:35:14.958Z   1

✓ Successfully created secret with name "password"

To read your secret, run:
  $ hcp vault-secrets secrets read password --app ExampleApplication

Read a secret

Use the vault-secrets command family to open secrets.

The open command returns the value of a secret.

$ hcp vault-secrets secrets open password
Secret Name:    password
Type:           kv
Created At:     2024-10-04T16:35:14.958Z
Latest Version: 1
Value:          WorstPasswordEver

Delete a secret

Use the vault-secrets command family to delete secrets.

The delete command to remove a secret.

$ hcp vault-secrets secrets  delete password
✓ Successfully deleted secret with name "password"

Logout of HCP Vault Secrets

Use the auth command family to logout.

$ hcp auth logout
Successfully logged out

HCP CLI overview for HCP Vault Secrets

Login to HCP Vault Secrets

Create a secret

Read a secret

Delete a secret

Logout of HCP Vault Secrets