# Avoid using root token to create approle secret

**URL:** <https://discuss.hashicorp.com/t/avoid-using-root-token-to-create-approle-secret/30411>\
**Category:** Vault\
**Created:** [October 7, 2021, 4:52pm UTC](https://discuss.hashicorp.com/t/avoid-using-root-token-to-create-approle-secret/30411 "2021-10-07T16:52:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Masber](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/masber/32/13497_2.png) [@Masber](https://discuss.hashicorp.com/u/Masber)\
**Post date:** [October 7, 2021, 4:52pm UTC](https://discuss.hashicorp.com/t/avoid-using-root-token-to-create-approle-secret/30411/1 "2021-10-07T16:52:54Z")

</div>

Dear Hashicorp community,

Based on this [example](https://learn.hashicorp.com/tutorials/vault/approle#response-wrap-the-secretid), does the “trusted entity” need to use the root token to generate the secretID? if not, how could I generate a token that can only generate secretsID for a specific policy?

thank you

---

<div class="post-metadata">

**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\
**Post date:** [October 7, 2021, 11:31pm UTC](https://discuss.hashicorp.com/t/avoid-using-root-token-to-create-approle-secret/30411/2 "2021-10-07T23:31:11Z")

</div>

You can use any token you want/can to setup your environment and authentication. The only thing you shouldn’t do is create other tokens without realizing and restricting what those tokens are capable of.

Best practice says, init, setup, and revoke the root token.